From ca0d385d6382df874cea7b7736ca5c2482717cd5 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 02:39:31 +0000 Subject: [PATCH 1/5] ci: adopt the shared osv-scan lane (infra#104) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Byte-identical copy of ci-workflows templates/deps.yml, pinned to osv-scan.yml@162accb, verified with `diff`. Adopted at HARD-FAIL (ci-workflows#15 flipped the template default), so green means genuinely clean rather than green by configuration. This repo carries deno.lock, so the scan has real coverage — its green will mean "scanned and clean" rather than "nothing to scan". Several repos in this wave only earn the second claim, so the distinction is worth stating. Deno is also the ecosystem where remediation has been hardest across this rollout: static-mcp needed a parent bump AND a lockfile promotion for the same transitive packages that npm resolved correctly on a plain relock. If this lane reds, expect rung 1 to be less likely to suffice here than it was on the npm repos. ci-workflows/REMEDIATION.md is the triage order: rung 1 first, stop at the first rung that works, do not skip to an acceptance. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01LF9Cu8u4dkCEM8MXC1QeDL --- .github/workflows/deps.yml | 97 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 97 insertions(+) create mode 100644 .github/workflows/deps.yml diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml new file mode 100644 index 0000000..1953ac3 --- /dev/null +++ b/.github/workflows/deps.yml @@ -0,0 +1,97 @@ +name: deps +# Dependency scanning via the org's shared lane (infra#104, ci-workflows#1). +# +# STANDARDIZED ORG-WIDE CALLER — copy this file byte-identical to +# .github/workflows/deps.yml in the adopting repo. Do not tailor it per repo: the +# scanner version, its sha256, and the deno.lock converter all live in the reusable +# workflow (one definition), and a fleet of identical callers means the next bump is +# one review of one diff, applied everywhere by the same sed. +# +# "BYTE-IDENTICAL" NOW MEANS BYTE-IDENTICAL. It previously carried one sanctioned +# divergence — the `report-only: true` grace line each repo deleted once its findings +# cleared — but the template no longer ships that line, so an adopter and this file +# should match exactly. Any difference is drift, including a stale pin. +# +# The one legitimate exception is a repo that genuinely could not clear a finding +# during adoption and therefore carries a DATED grace block (see the posture note +# below). That is a deliberate, reviewable, self-expiring divergence — not drift. +# +# Unlike the canonical script, nothing gates this: templates/ has no drift lane +# against its callers, so a caller left behind is invisible until someone diffs it. +# That is exactly how the two 2026-07-30 adopters ended up four commits back with +# nobody noticing (ci-workflows#10). Until such a gate exists, re-pin the callers in +# the same change that bumps this file. +# +# NOT every consumer is a byte-identical copy. A repo that already has a single +# combined test workflow may call the reusable lane from inside it instead (infra's +# infra-test.yml does). Those are legitimate and are NOT measured against this file +# — but they still carry a pin, and it still goes stale the same way. +# +# What a green check means: every lockfile ecosystem osv-scanner supports, plus the +# npm subset of any v4/v5 deno.lock (converted in-lane). Still not scannable by +# anything today, and logged per run: jsr-native deps and @jsr/* npm-compat mirrors +# (OSV has no JSR ecosystem). A repo with nothing scannable passes rather than +# red-lining. +# +# Failure posture is HARD-FAIL, and this template now ships it that way — no `with:` +# block at all. Adopt as-is and the check is honest from its first run: green means +# genuinely clean. +# +# THIS REVERSES THE EARLIER DEFAULT, on evidence. The template used to ship +# `report-only: true` because 5 of the first 8 repos scanned carried pre-existing +# advisories, so blocking adoption on remediation looked like it would leave most +# repos uninstrumented. That rate did not hold — waves 3–6 were almost entirely +# clean, six repos in total rather than forty (ci-workflows#8). Shipping grace to +# everyone to spare the few cost more than it saved: 30 repos later needed a +# second sweep to take the flag back off, and while it was on it masked a CVSS 8.8 +# on `site` behind a green check. +# +# IF ADOPTION IS BLOCKED BY A PRE-EXISTING FINDING, work REMEDIATION.md first — +# start at rung 1, stop at the first rung that works. Most reds clear with a relock. +# Only if the finding cannot be cleared in the adoption PR, add grace, AND DATE IT: +# +# with: +# report-only: true +# grace-expires: "YYYY-MM-DD" # a real date, not a placeholder +# +# From that date findings fail hard again. Omit the date and the lane warns on every +# run that the grace is unbounded — because unbounded grace is the +# required-baseline.yml failure (infra#135), a control that reads green while gating +# nothing. A malformed date fails CLOSED; a typo must not be the permissive setting. +# +# Grace downgrades VULNERABILITY findings only. A tool or network failure still fails +# hard in every mode — a lane that cannot run must never report green. +# +# Progress tracked in ci-workflows#2. +# +# The reviewable escape hatch for an accepted or unfixable finding is an +# osv-scanner.toml [[IgnoredVulns]] entry next to the lockfile, with a written reason +# AND an `ignoreUntil` date — osv-scanner expires the entry itself and the finding +# returns. Full triage order in REMEDIATION.md: start at rung 1, stop at the first +# rung that works, and do not skip to an acceptance. +# +# The weekly rescan exists because advisories are published against locks that are +# not changing: a repo that merges rarely would otherwise stay green on stale +# information indefinitely. Tuesday, one day after ci-workflows' Monday self-test — +# the canary catches a broken digest or release URL fleet-wide BEFORE the fleet +# rescans on it. +# +# NOT path-filtered, deliberately: a check that is skipped on some PRs cannot be +# made a required check without the skipped-required-check problem. +on: + pull_request: + push: + branches: [main] + schedule: + - cron: "23 7 * * 2" + workflow_dispatch: {} +concurrency: + group: deps-${{ github.ref }} + cancel-in-progress: true +permissions: + contents: read +jobs: + osv: + # SHA-pinned per org policy. `# main` records what the SHA was at the time, so a + # reviewer can tell an intentional bump from a drifted one. + uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@162accbbcfdfd12c146c44f23770e6a6bb9abb1c # main From cbfa73eaaa623263987d8041ec0d10589f6a08ae Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 03:08:33 +0000 Subject: [PATCH 2/5] =?UTF-8?q?deps:=20relock=20now=20that=20cdn.jsdelivr.?= =?UTF-8?q?net=20is=20reachable=20=E2=80=94=20clears=207=20of=209=20adviso?= =?UTF-8?q?ries?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The blocker reported earlier in this PR is gone: cdn.jsdelivr.net went from a 403 at CONNECT to 301 once it was added to the environment's domain allowlist, live, with no session restart. That made lume's graph resolvable and the lockfile regenerable. RUNG 1 — relock only, deno.json UNCHANGED: ajv 8.17.1 -> 8.20.0 clears GHSA-2g4f-4pwh-qvx6 fast-uri 3.1.0 -> 3.1.4 clears all four fast-uri advisories linkify-it 5.0.0 -> 5.0.2 clears GHSA-22p9-wv53-3rq4 (CVSS 8.7) and GHSA-v245-v573-v5vm mdurl 2.0.0 -> 2.1.0 (incidental) Seven of the nine, including the highest-severity finding in this wave. STILL OPEN: markdown-it 14.1.0 (GHSA-38c4-r59v-3vqw 5.5, GHSA-6v5v-wf23-fmfq 5.3), needs 14.2.0. This is blocked upstream, not by effort. lume pins markdown-it at EXACTLY 14.1.0 in deps/markdown_it.ts, so no relock can move it, and rung 2 does not help either: v3.2.1 is the newest lume published and it carries the same exact pin. Verified by fetching both versions' deps file rather than assuming. The remaining path is a lockfile promotion or a dated acceptance, and neither should be taken silently — left for a human call. LOCK SHRANK 52 -> 46 npm ENTRIES, AND THAT IS CORRECT HERE — checked, per the rule this wave established. What left: nunjucks and its four deps (@types/nunjucks, a-sync-waterfall, asap, commander), plus a duplicate zod 3.24.1 collapsing into 3.25.76. Nothing in src/ imports the lume nunjucks plugin — site.ts imports json_ld, metas, robots, sitemap and vento — so those were stale entries the committed lock had been carrying, not coverage being dropped. No package carrying an advisory disappeared; markdown-it is still present and still reported, which is the proof the scan did not go quiet by omission. Verified against api.osv.dev directly: ajv, fast-uri, linkify-it and mdurl all return zero advisories at the resolved versions; markdown-it still returns its two. `deno check src/unfold/site/site.ts` passes. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01LF9Cu8u4dkCEM8MXC1QeDL --- deno.lock | 148 +++++++++++++++++------------------------------------- 1 file changed, 47 insertions(+), 101 deletions(-) diff --git a/deno.lock b/deno.lock index ed36e71..16c17cf 100644 --- a/deno.lock +++ b/deno.lock @@ -1,83 +1,59 @@ { "version": "5", "specifiers": { - "jsr:@std/assert@1": "1.0.17", - "jsr:@std/assert@^1.0.17": "1.0.17", - "jsr:@std/bytes@^1.0.6": "1.0.6", "jsr:@std/cli@1.0.25": "1.0.25", "jsr:@std/cli@^1.0.25": "1.0.25", - "jsr:@std/collections@^1.1.3": "1.1.4", + "jsr:@std/collections@^1.1.3": "1.3.0", "jsr:@std/crypto@1.0.5": "1.0.5", - "jsr:@std/csv@^1.0.6": "1.0.6", "jsr:@std/encoding@1.0.10": "1.0.10", "jsr:@std/encoding@^1.0.10": "1.0.10", "jsr:@std/fmt@1.0.8": "1.0.8", "jsr:@std/fmt@^1.0.8": "1.0.8", - "jsr:@std/front-matter@*": "1.0.9", "jsr:@std/front-matter@1.0.9": "1.0.9", - "jsr:@std/front-matter@^1.0.9": "1.0.9", "jsr:@std/fs@1.0.21": "1.0.21", - "jsr:@std/fs@^1.0.21": "1.0.22", - "jsr:@std/fs@^1.0.22": "1.0.22", - "jsr:@std/html@^1.0.5": "1.0.5", + "jsr:@std/fs@^1.0.21": "1.0.24", + "jsr:@std/fs@^1.0.22": "1.0.24", + "jsr:@std/html@^1.0.5": "1.0.7", "jsr:@std/http@1.0.23": "1.0.23", - "jsr:@std/internal@^1.0.12": "1.0.12", - "jsr:@std/json@^1.0.2": "1.0.2", + "jsr:@std/internal@^1.0.12": "1.0.14", + "jsr:@std/internal@^1.0.14": "1.0.14", + "jsr:@std/json@^1.0.2": "1.1.0", "jsr:@std/jsonc@1.0.2": "1.0.2", "jsr:@std/media-types@^1.1.0": "1.1.0", "jsr:@std/net@^1.0.6": "1.0.6", "jsr:@std/path@1.1.4": "1.1.4", - "jsr:@std/path@^1.1.4": "1.1.4", + "jsr:@std/path@^1.1.4": "1.1.6", + "jsr:@std/path@^1.1.5": "1.1.6", "jsr:@std/semver@1.0.7": "1.0.7", - "jsr:@std/streams@^1.0.16": "1.0.17", - "jsr:@std/streams@^1.0.9": "1.0.17", + "jsr:@std/streams@^1.0.16": "1.1.1", "jsr:@std/toml@1.0.11": "1.0.11", "jsr:@std/toml@^1.0.3": "1.0.11", "jsr:@std/yaml@1.0.10": "1.0.10", - "jsr:@std/yaml@^1.0.5": "1.0.11", - "npm:@types/nunjucks@3.2.6": "3.2.6", - "npm:ajv-formats@^3.0.1": "3.0.1_ajv@8.17.1", - "npm:ajv@^8.17.1": "8.17.1", + "jsr:@std/yaml@^1.0.5": "1.0.10", + "npm:ajv-formats@^3.0.1": "3.0.1_ajv@8.20.0", + "npm:ajv@^8.17.1": "8.20.0", "npm:esbuild@0.27.2": "0.27.2", "npm:lightningcss-wasm@1.30.2": "1.30.2", "npm:markdown-it-attrs@4.3.1": "4.3.1_markdown-it@14.1.0", "npm:markdown-it-deflist@3.0.0": "3.0.0", "npm:markdown-it@14.1.0": "14.1.0", - "npm:nunjucks@3.2.4": "3.2.4", "npm:remove-markdown@0.6.2": "0.6.2", "npm:schema-dts@1.1.5": "1.1.5", - "npm:zod@*": "3.25.76", - "npm:zod@3.24.1": "3.24.1", "npm:zod@^3.25.76": "3.25.76" }, "jsr": { - "@std/assert@1.0.17": { - "integrity": "df5ebfffe77c03b3fa1401e11c762cc8f603d51021c56c4d15a8c7ab45e90dbe", - "dependencies": [ - "jsr:@std/internal" - ] - }, - "@std/bytes@1.0.6": { - "integrity": "f6ac6adbd8ccd99314045f5703e23af0a68d7f7e58364b47d2c7f408aeb5820a" - }, "@std/cli@1.0.25": { "integrity": "1f85051b370c97a7a9dfc6ba626e7ed57a91bea8c081597276d1e78d929d8c91", "dependencies": [ - "jsr:@std/internal" + "jsr:@std/internal@^1.0.12" ] }, - "@std/collections@1.1.4": { - "integrity": "90a7acae07652b0f7227db9b22116ddf4b7cfb0886f8e409c1d7f0c39c526bc1" + "@std/collections@1.3.0": { + "integrity": "eb36b43d784477ea0b476483ac034a14bdd182aff921c812ecf662a1fcef9498" }, "@std/crypto@1.0.5": { "integrity": "0dcfbb319fe0bba1bd3af904ceb4f948cde1b92979ec1614528380ed308a3b40" }, - "@std/csv@1.0.6": { - "integrity": "52ef0e62799a0028d278fa04762f17f9bd263fad9a8e7f98c14fbd371d62d9fd", - "dependencies": [ - "jsr:@std/streams@^1.0.9" - ] - }, "@std/encoding@1.0.10": { "integrity": "8783c6384a2d13abd5e9e87a7ae0520a30e9f56aeeaa3bdf910a3eaaf5c811a1" }, @@ -94,19 +70,19 @@ "@std/fs@1.0.21": { "integrity": "d720fe1056d78d43065a4d6e0eeb2b19f34adb8a0bc7caf3a4dbf1d4178252cd", "dependencies": [ - "jsr:@std/internal", + "jsr:@std/internal@^1.0.12", "jsr:@std/path@^1.1.4" ] }, - "@std/fs@1.0.22": { - "integrity": "de0f277a58a867147a8a01bc1b181d0dfa80bfddba8c9cf2bacd6747bcec9308", + "@std/fs@1.0.24": { + "integrity": "f3061b45b81673a2bece689da041df32d174be064c89eb6397fb5718d3fb7877", "dependencies": [ - "jsr:@std/internal", - "jsr:@std/path@^1.1.4" + "jsr:@std/internal@^1.0.14", + "jsr:@std/path@^1.1.5" ] }, - "@std/html@1.0.5": { - "integrity": "4e2d693f474cae8c16a920fa5e15a3b72267b94b84667f11a50c6dd1cb18d35e" + "@std/html@1.0.7": { + "integrity": "175c818905a6e75743c69c251395e273d82698e58cfe7dd76268d70e28b8d8fe" }, "@std/http@1.0.23": { "integrity": "6634e9e034c589bf35101c1b5ee5bbf052a5987abca20f903e58bdba85c80dee", @@ -119,14 +95,14 @@ "jsr:@std/media-types", "jsr:@std/net", "jsr:@std/path@^1.1.4", - "jsr:@std/streams@^1.0.16" + "jsr:@std/streams" ] }, - "@std/internal@1.0.12": { - "integrity": "972a634fd5bc34b242024402972cd5143eac68d8dffaca5eaa4dba30ce17b027" + "@std/internal@1.0.14": { + "integrity": "291516b3d4c35024d6ffbc0a9df5bf4c64116e05b50012cf846710152d2ffdf7" }, - "@std/json@1.0.2": { - "integrity": "d9e5497801c15fb679f55a2c01c7794ad7a5dfda4dd1bebab5e409cb5e0d34d4" + "@std/json@1.1.0": { + "integrity": "93330d3ed4054d6b1ffe54b075432c80a5f671be77277b978931e018014cb1cc" }, "@std/jsonc@1.0.2": { "integrity": "909605dae3af22bd75b1cbda8d64a32cf1fd2cf6efa3f9e224aba6d22c0f44c7", @@ -143,17 +119,20 @@ "@std/path@1.1.4": { "integrity": "1d2d43f39efb1b42f0b1882a25486647cb851481862dc7313390b2bb044314b5", "dependencies": [ - "jsr:@std/internal" + "jsr:@std/internal@^1.0.12" + ] + }, + "@std/path@1.1.6": { + "integrity": "c68485c2a4dfbb5ae3cc74fae4e8c4e5d874cf8a8ed12927917235c758b46cbe", + "dependencies": [ + "jsr:@std/internal@^1.0.14" ] }, "@std/semver@1.0.7": { "integrity": "7d5f65391762dc4358abde80fc3354086ddb40101f140295e60f290c138887d0" }, - "@std/streams@1.0.17": { - "integrity": "7859f3d9deed83cf4b41f19223d4a67661b3d3819e9fc117698f493bf5992140", - "dependencies": [ - "jsr:@std/bytes" - ] + "@std/streams@1.1.1": { + "integrity": "92556d350e537e9dce527a6d08f6f15be3ff65e656079dea69d15252187c7613" }, "@std/toml@1.0.11": { "integrity": "e084988b872ca4bad6aedfb7350f6eeed0e8ba88e9ee5e1590621c5b5bb8f715", @@ -163,9 +142,6 @@ }, "@std/yaml@1.0.10": { "integrity": "245706ea3511cc50c8c6d00339c23ea2ffa27bd2c7ea5445338f8feff31fa58e" - }, - "@std/yaml@1.0.11": { - "integrity": "bd139ce77f2d06cbed3713c8b26d301d2a2e12ecc7986130a268107e212143ee" } }, "npm": { @@ -299,13 +275,7 @@ "os": ["win32"], "cpu": ["x64"] }, - "@types/nunjucks@3.2.6": { - "integrity": "sha512-pHiGtf83na1nCzliuAdq8GowYiXvH5l931xZ0YEHaLMNFgynpEqx+IPStlu7UaDkehfvl01e4x/9Tpwhy7Ue3w==" - }, - "a-sync-waterfall@1.0.1": { - "integrity": "sha512-RYTOHHdWipFUliRFMCS4X2Yn2X8M87V/OpSqWzKKOGhzqyUxzyVmhHDH9sAvG+ZuQf/TAOFsLCpMw09I1ufUnA==" - }, - "ajv-formats@3.0.1_ajv@8.17.1": { + "ajv-formats@3.0.1_ajv@8.20.0": { "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==", "dependencies": [ "ajv" @@ -314,8 +284,8 @@ "ajv" ] }, - "ajv@8.17.1": { - "integrity": "sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==", + "ajv@8.20.0": { + "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==", "dependencies": [ "fast-deep-equal", "fast-uri", @@ -326,12 +296,6 @@ "argparse@2.0.1": { "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==" }, - "asap@2.0.6": { - "integrity": "sha512-BSHWgDSAiKs50o2Re8ppvp3seVHXSRM44cdSsT9FfNEUUZLOGWVCsiWaRPWM1Znn+mqZ1OfVZ3z3DWEzSp7hRA==" - }, - "commander@5.1.0": { - "integrity": "sha512-P0CysNDQ7rtVw4QIQtm+MRxV66vKFSvlsQvGYXZWR3qFU0jlMKHZZZgw8e+8DSah4UDKMqnknRDQz+xuQXQ/Zg==" - }, "entities@4.5.0": { "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==" }, @@ -371,8 +335,8 @@ "fast-deep-equal@3.1.3": { "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==" }, - "fast-uri@3.1.0": { - "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==" + "fast-uri@3.1.4": { + "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==" }, "json-schema-traverse@1.0.0": { "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==" @@ -380,8 +344,8 @@ "lightningcss-wasm@1.30.2": { "integrity": "sha512-3QB24h07oFTwiXI/wItgEv5De1prsmrZFWluuTyLO7/CFk4kEC5zgG7V6qQNGLBB5+QhSnGMixUALWHXj+J3Ug==" }, - "linkify-it@5.0.0": { - "integrity": "sha512-5aHCbzQRADcdP+ATqnDuhhJ/MRIqDkZX5pyjFHRRysS8vZ5AbqGEoFIb6pYHPZ+L/OC2Lc+xT8uHVVR5CAK/wQ==", + "linkify-it@5.0.2": { + "integrity": "sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q==", "dependencies": [ "uc.micro" ] @@ -407,17 +371,8 @@ ], "bin": true }, - "mdurl@2.0.0": { - "integrity": "sha512-Lf+9+2r+Tdp5wXDXC4PcIBjTDtq4UKjCPMQhKIuzpJNW0b96kVqSwW0bT7FhRSfmAiFYgP+SCRvdrDozfh0U5w==" - }, - "nunjucks@3.2.4": { - "integrity": "sha512-26XRV6BhkgK0VOxfbU5cQI+ICFUtMLixv1noZn1tGU38kQH5A5nmmbk/O45xdyBhD1esk47nKrY0mvQpZIhRjQ==", - "dependencies": [ - "a-sync-waterfall", - "asap", - "commander" - ], - "bin": true + "mdurl@2.1.0": { + "integrity": "sha512-1+HBaOx0zi/dQWht8rNv9MYf9qqpqL/kxI0hXImU6Y547zM6Sni8BQibt7ifgMcYtQg41ao3Ivd6cnSM86inpg==" }, "punycode.js@2.3.1": { "integrity": "sha512-uxFIHU0YlHYhDQtV4R9J6a52SLx28BCjT+4ieh7IGbgwVJWO+km431c4yRlREUAsAmt/uMjQUyQHNEPf0M39CA==" @@ -434,19 +389,12 @@ "uc.micro@2.1.0": { "integrity": "sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A==" }, - "zod@3.24.1": { - "integrity": "sha512-muH7gBL9sI1nciMZV67X5fTKKBLtwpZ5VBp1vsOQzj1MhrBZ4wlVCm3gedKZWLp0Oyel8sIGfeiz54Su+OVT+A==" - }, "zod@3.25.76": { "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==" } }, "redirects": { - "https://deno.land/x/deno_dom/deno-dom-wasm.ts": "https://deno.land/x/deno_dom@v0.1.56/deno-dom-wasm.ts", - "https://deno.land/x/lume/mod.ts": "https://deno.land/x/lume@v3.1.4/mod.ts", - "https://deno.land/x/lume/plugins/json.ts": "https://deno.land/x/lume@v3.1.4/plugins/json.ts", - "https://deno.land/x/lume/plugins/modules.ts": "https://deno.land/x/lume@v3.1.4/plugins/modules.ts", - "https://deno.land/x/lume/plugins/nunjucks.ts": "https://deno.land/x/lume@v3.1.4/plugins/nunjucks.ts" + "https://deno.land/x/deno_dom/deno-dom-wasm.ts": "https://deno.land/x/deno_dom@v0.1.56/deno-dom-wasm.ts" }, "remote": { "https://cdn.jsdelivr.net/gh/b-fuze/deno-dom@0.1.56/build/deno-wasm/deno-wasm-dynamic.js": "fd05e83a855aa68b09396dc47a7638ef526c39917971715ac37e0fc3227db886", @@ -588,7 +536,6 @@ "https://deno.land/x/lume@v3.1.4/deps/jsonc.ts": "79f0eddc3c9e593310eb8e5918eb1506b1c7d7816e4ecb96894f634ecbe626ff", "https://deno.land/x/lume@v3.1.4/deps/lightningcss.ts": "9ae4e32c6b6854d5a2b955970a0f2143853511a329b275102423044b67c9c514", "https://deno.land/x/lume@v3.1.4/deps/markdown_it.ts": "24c1c0fd18c99b9067d9ff5d051f934cb7c3446e6afbad934f6268af8d1ceb4d", - "https://deno.land/x/lume@v3.1.4/deps/nunjucks.ts": "55e88a22192b3d87ac4cde3dcb3fe23db610bc4f7e373c1ca6df9610aa2ac632", "https://deno.land/x/lume@v3.1.4/deps/path.ts": "a3d24ee31773ba6ef19b588612f376acef0ad5d3d761c4d9a315f79036cc87a4", "https://deno.land/x/lume@v3.1.4/deps/remove-markdown.ts": "e304dcdd2c1042a1de5b2df53c9c8c39f4462307f95d13e4b2fa1ded26851013", "https://deno.land/x/lume@v3.1.4/deps/schema-dts.ts": "cbf7506dba867d835e40fb2523d5f646ade1ff241166872734076ed5eff6a23f", @@ -604,7 +551,6 @@ "https://deno.land/x/lume@v3.1.4/plugins/markdown.ts": "7e82d897c1e35bf119dcd18b6aec7a6ba5aa06848897b34ff9cd161ec7c8757e", "https://deno.land/x/lume@v3.1.4/plugins/metas.ts": "1e5826aadd5856af0c28a34e2f5580c718aa6cee6e7d7c63835e7c22467dc310", "https://deno.land/x/lume@v3.1.4/plugins/modules.ts": "4e177c0ffe972b9deef10db2bf0ae52b405418af4dbac03db9e7ffbd6a3ec6ae", - "https://deno.land/x/lume@v3.1.4/plugins/nunjucks.ts": "7c576731ddb622099cb99a250227018e3a47cf82d11ba25e114fbe9d45c8d839", "https://deno.land/x/lume@v3.1.4/plugins/paginate.ts": "6a1a9a24d0fabed2f722a6a6f29d98559219c69475685034181816e82d367f2e", "https://deno.land/x/lume@v3.1.4/plugins/robots.ts": "8fe0e4aeba1b28d7f8e4810b1f8bc3f71e0fdb93b3108ebdcd4299e1ea66f18e", "https://deno.land/x/lume@v3.1.4/plugins/search.ts": "5acb5be828bbbd012fb9226cb97ec3e370d43d05aa44d16e7e7d50bab368b442", From 72e7ece11bbeb53ba0ac5da92287ad5438e6a356 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 03:10:17 +0000 Subject: [PATCH 3/5] =?UTF-8?q?deps:=20bump=20lume=20to=20v3.2.5=20?= =?UTF-8?q?=E2=80=94=20clears=20an=20eighth=20advisory,=20one=20left?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Correction to the previous commit's claim. It said "v3.2.1 is the newest lume published"; that was wrong, and wrong because of how it was checked. Version numbers were guessed one at a time against deno.land, which skipped v3.2.2, v3.2.4 and v3.2.5. Once cdn.deno.land was allowlisted the authoritative list was available: 213 versions, latest v3.2.5. RUNG 2: lume v3.1.4 -> v3.2.5 in deno.json (both the lume/ and lume/plugins/ prefixes), which moves its exact markdown-it pin 14.1.0 -> 14.1.1 and clears GHSA-38c4-r59v-3vqw. 8 of 9 advisories now cleared. STILL OPEN, and genuinely stuck upstream: GHSA-6v5v-wf23-fmfq on markdown-it 14.1.1, which needs 14.2.0. Latest lume pins 14.1.1 exactly, so no lume version reaches it. Confirmed by reading deps/markdown_it.ts from v3.2.2, v3.2.4 and v3.2.5 rather than inferring from the version number. Remaining options are a lockfile promotion or a dated acceptance; both are judgement calls and neither is being taken silently here. Lock grew 46 -> 68 npm entries — the opposite of the shrink this wave has been watching for, and expected, since lume 3.2.5 carries more dependencies than 3.1.4. Verified: ajv, fast-uri and linkify-it return zero advisories from api.osv.dev at their resolved versions; markdown-it 14.1.1 returns exactly one. `deno check src/unfold/site/site.ts` passes against the new lume. `deno test` fails, and did so identically BEFORE this change: manifest.ts imports src/unfold/site/site_url.ts, which does not exist in the repo. That is pre-existing and unrelated to dependencies — verified by stashing these changes and re-running. It does mean the test suite cannot corroborate the lume major bump; the typecheck of the lume-importing module is the strongest signal available here. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01LF9Cu8u4dkCEM8MXC1QeDL --- deno.json | 4 +- deno.lock | 564 +++++++++++++++++++++++++++++++++--------------------- 2 files changed, 345 insertions(+), 223 deletions(-) diff --git a/deno.json b/deno.json index 41f930f..6186eaf 100644 --- a/deno.json +++ b/deno.json @@ -34,8 +34,8 @@ "ajv": "npm:ajv@^8.17.1", "ajv-formats": "npm:ajv-formats@^3.0.1", "deno-dom-wasm": "https://deno.land/x/deno_dom/deno-dom-wasm.ts", - "lume/": "https://deno.land/x/lume@v3.1.4/", - "lume/plugins/": "https://deno.land/x/lume@v3.1.4/plugins/", + "lume/": "https://deno.land/x/lume@v3.2.5/", + "lume/plugins/": "https://deno.land/x/lume@v3.2.5/plugins/", "zod": "npm:zod@^3.25.76" }, "lint": { diff --git a/deno.lock b/deno.lock index 16c17cf..be38e6d 100644 --- a/deno.lock +++ b/deno.lock @@ -1,20 +1,18 @@ { "version": "5", "specifiers": { - "jsr:@std/cli@1.0.25": "1.0.25", - "jsr:@std/cli@^1.0.25": "1.0.25", + "jsr:@std/cli@1.0.29": "1.0.29", + "jsr:@std/cli@^1.0.29": "1.0.29", "jsr:@std/collections@^1.1.3": "1.3.0", - "jsr:@std/crypto@1.0.5": "1.0.5", - "jsr:@std/encoding@1.0.10": "1.0.10", - "jsr:@std/encoding@^1.0.10": "1.0.10", - "jsr:@std/fmt@1.0.8": "1.0.8", - "jsr:@std/fmt@^1.0.8": "1.0.8", + "jsr:@std/encoding@^1.0.10": "1.0.11", + "jsr:@std/fmt@1.0.10": "1.0.10", + "jsr:@std/fmt@^1.0.10": "1.0.10", "jsr:@std/front-matter@1.0.9": "1.0.9", - "jsr:@std/fs@1.0.21": "1.0.21", - "jsr:@std/fs@^1.0.21": "1.0.24", + "jsr:@std/fs@1.0.23": "1.0.23", "jsr:@std/fs@^1.0.22": "1.0.24", - "jsr:@std/html@^1.0.5": "1.0.7", - "jsr:@std/http@1.0.23": "1.0.23", + "jsr:@std/fs@^1.0.23": "1.0.24", + "jsr:@std/html@^1.0.6": "1.0.7", + "jsr:@std/http@1.1.0": "1.1.0", "jsr:@std/internal@^1.0.12": "1.0.14", "jsr:@std/internal@^1.0.14": "1.0.14", "jsr:@std/json@^1.0.2": "1.1.0", @@ -24,41 +22,35 @@ "jsr:@std/path@1.1.4": "1.1.4", "jsr:@std/path@^1.1.4": "1.1.6", "jsr:@std/path@^1.1.5": "1.1.6", - "jsr:@std/semver@1.0.7": "1.0.7", - "jsr:@std/streams@^1.0.16": "1.1.1", + "jsr:@std/semver@1.0.8": "1.0.8", + "jsr:@std/streams@^1.1.0": "1.1.1", "jsr:@std/toml@1.0.11": "1.0.11", "jsr:@std/toml@^1.0.3": "1.0.11", - "jsr:@std/yaml@1.0.10": "1.0.10", - "jsr:@std/yaml@^1.0.5": "1.0.10", + "jsr:@std/yaml@1.1.0": "1.1.0", + "jsr:@std/yaml@^1.0.5": "1.1.0", "npm:ajv-formats@^3.0.1": "3.0.1_ajv@8.20.0", "npm:ajv@^8.17.1": "8.20.0", - "npm:esbuild@0.27.2": "0.27.2", - "npm:lightningcss-wasm@1.30.2": "1.30.2", - "npm:markdown-it-attrs@4.3.1": "4.3.1_markdown-it@14.1.0", + "npm:esbuild@0.28.0": "0.28.0", + "npm:lightningcss-wasm@1.32.0": "1.32.0", + "npm:markdown-it-attrs@4.5.0": "4.5.0_markdown-it@14.1.1", "npm:markdown-it-deflist@3.0.0": "3.0.0", - "npm:markdown-it@14.1.0": "14.1.0", - "npm:remove-markdown@0.6.2": "0.6.2", - "npm:schema-dts@1.1.5": "1.1.5", + "npm:markdown-it@14.1.1": "14.1.1", + "npm:remove-markdown@0.6.4": "0.6.4", + "npm:schema-dts@2.0.0": "2.0.0_typescript@7.0.2", "npm:zod@^3.25.76": "3.25.76" }, "jsr": { - "@std/cli@1.0.25": { - "integrity": "1f85051b370c97a7a9dfc6ba626e7ed57a91bea8c081597276d1e78d929d8c91", - "dependencies": [ - "jsr:@std/internal@^1.0.12" - ] + "@std/cli@1.0.29": { + "integrity": "fa4ef29130baa834d8a13b7d138240c3a2fcfba740bfb7afa646a360a15ec84f" }, "@std/collections@1.3.0": { "integrity": "eb36b43d784477ea0b476483ac034a14bdd182aff921c812ecf662a1fcef9498" }, - "@std/crypto@1.0.5": { - "integrity": "0dcfbb319fe0bba1bd3af904ceb4f948cde1b92979ec1614528380ed308a3b40" + "@std/encoding@1.0.11": { + "integrity": "e7cef2f0b3153bccc17431e7c864a1de03a4b6d9647389c43e08aaa775d37385" }, - "@std/encoding@1.0.10": { - "integrity": "8783c6384a2d13abd5e9e87a7ae0520a30e9f56aeeaa3bdf910a3eaaf5c811a1" - }, - "@std/fmt@1.0.8": { - "integrity": "71e1fc498787e4434d213647a6e43e794af4fd393ef8f52062246e06f7e372b7" + "@std/fmt@1.0.10": { + "integrity": "90dfba288802ac6de82fb31d0917eb9e4450b9925b954d5e51fc29ac07419db5" }, "@std/front-matter@1.0.9": { "integrity": "ee6201d06674cbef137dda2252f62477450b48249e7d8d9ab57a30f85ff6f051", @@ -67,10 +59,9 @@ "jsr:@std/yaml@^1.0.5" ] }, - "@std/fs@1.0.21": { - "integrity": "d720fe1056d78d43065a4d6e0eeb2b19f34adb8a0bc7caf3a4dbf1d4178252cd", + "@std/fs@1.0.23": { + "integrity": "3ecbae4ce4fee03b180fa710caff36bb5adb66631c46a6460aaad49515565a37", "dependencies": [ - "jsr:@std/internal@^1.0.12", "jsr:@std/path@^1.1.4" ] }, @@ -84,13 +75,13 @@ "@std/html@1.0.7": { "integrity": "175c818905a6e75743c69c251395e273d82698e58cfe7dd76268d70e28b8d8fe" }, - "@std/http@1.0.23": { - "integrity": "6634e9e034c589bf35101c1b5ee5bbf052a5987abca20f903e58bdba85c80dee", + "@std/http@1.1.0": { + "integrity": "265cd9a589fea924c5bb0bbed8bebb4bb2fa19129f760bd014e78dbd7a365a51", "dependencies": [ - "jsr:@std/cli@^1.0.25", - "jsr:@std/encoding@^1.0.10", - "jsr:@std/fmt@^1.0.8", - "jsr:@std/fs@^1.0.21", + "jsr:@std/cli@^1.0.29", + "jsr:@std/encoding", + "jsr:@std/fmt@^1.0.10", + "jsr:@std/fs@^1.0.23", "jsr:@std/html", "jsr:@std/media-types", "jsr:@std/net", @@ -128,8 +119,8 @@ "jsr:@std/internal@^1.0.14" ] }, - "@std/semver@1.0.7": { - "integrity": "7d5f65391762dc4358abde80fc3354086ddb40101f140295e60f290c138887d0" + "@std/semver@1.0.8": { + "integrity": "dc830e8b8b6a380c895d53fbfd1258dc253704ca57bbe1629ac65fd7830179b7" }, "@std/streams@1.1.1": { "integrity": "92556d350e537e9dce527a6d08f6f15be3ff65e656079dea69d15252187c7613" @@ -140,138 +131,238 @@ "jsr:@std/collections" ] }, - "@std/yaml@1.0.10": { - "integrity": "245706ea3511cc50c8c6d00339c23ea2ffa27bd2c7ea5445338f8feff31fa58e" + "@std/yaml@1.1.0": { + "integrity": "fc1c5c63e05c4c5eb6118355f557958035d41940d6c29d35b306ef7155d6edb0" } }, "npm": { - "@esbuild/aix-ppc64@0.27.2": { - "integrity": "sha512-GZMB+a0mOMZs4MpDbj8RJp4cw+w1WV5NYD6xzgvzUJ5Ek2jerwfO2eADyI6ExDSUED+1X8aMbegahsJi+8mgpw==", + "@esbuild/aix-ppc64@0.28.0": { + "integrity": "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA==", "os": ["aix"], "cpu": ["ppc64"] }, - "@esbuild/android-arm64@0.27.2": { - "integrity": "sha512-pvz8ZZ7ot/RBphf8fv60ljmaoydPU12VuXHImtAs0XhLLw+EXBi2BLe3OYSBslR4rryHvweW5gmkKFwTiFy6KA==", + "@esbuild/android-arm64@0.28.0": { + "integrity": "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw==", "os": ["android"], "cpu": ["arm64"] }, - "@esbuild/android-arm@0.27.2": { - "integrity": "sha512-DVNI8jlPa7Ujbr1yjU2PfUSRtAUZPG9I1RwW4F4xFB1Imiu2on0ADiI/c3td+KmDtVKNbi+nffGDQMfcIMkwIA==", + "@esbuild/android-arm@0.28.0": { + "integrity": "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ==", "os": ["android"], "cpu": ["arm"] }, - "@esbuild/android-x64@0.27.2": { - "integrity": "sha512-z8Ank4Byh4TJJOh4wpz8g2vDy75zFL0TlZlkUkEwYXuPSgX8yzep596n6mT7905kA9uHZsf/o2OJZubl2l3M7A==", + "@esbuild/android-x64@0.28.0": { + "integrity": "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA==", "os": ["android"], "cpu": ["x64"] }, - "@esbuild/darwin-arm64@0.27.2": { - "integrity": "sha512-davCD2Zc80nzDVRwXTcQP/28fiJbcOwvdolL0sOiOsbwBa72kegmVU0Wrh1MYrbuCL98Omp5dVhQFWRKR2ZAlg==", + "@esbuild/darwin-arm64@0.28.0": { + "integrity": "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q==", "os": ["darwin"], "cpu": ["arm64"] }, - "@esbuild/darwin-x64@0.27.2": { - "integrity": "sha512-ZxtijOmlQCBWGwbVmwOF/UCzuGIbUkqB1faQRf5akQmxRJ1ujusWsb3CVfk/9iZKr2L5SMU5wPBi1UWbvL+VQA==", + "@esbuild/darwin-x64@0.28.0": { + "integrity": "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ==", "os": ["darwin"], "cpu": ["x64"] }, - "@esbuild/freebsd-arm64@0.27.2": { - "integrity": "sha512-lS/9CN+rgqQ9czogxlMcBMGd+l8Q3Nj1MFQwBZJyoEKI50XGxwuzznYdwcav6lpOGv5BqaZXqvBSiB/kJ5op+g==", + "@esbuild/freebsd-arm64@0.28.0": { + "integrity": "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q==", "os": ["freebsd"], "cpu": ["arm64"] }, - "@esbuild/freebsd-x64@0.27.2": { - "integrity": "sha512-tAfqtNYb4YgPnJlEFu4c212HYjQWSO/w/h/lQaBK7RbwGIkBOuNKQI9tqWzx7Wtp7bTPaGC6MJvWI608P3wXYA==", + "@esbuild/freebsd-x64@0.28.0": { + "integrity": "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw==", "os": ["freebsd"], "cpu": ["x64"] }, - "@esbuild/linux-arm64@0.27.2": { - "integrity": "sha512-hYxN8pr66NsCCiRFkHUAsxylNOcAQaxSSkHMMjcpx0si13t1LHFphxJZUiGwojB1a/Hd5OiPIqDdXONia6bhTw==", + "@esbuild/linux-arm64@0.28.0": { + "integrity": "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A==", "os": ["linux"], "cpu": ["arm64"] }, - "@esbuild/linux-arm@0.27.2": { - "integrity": "sha512-vWfq4GaIMP9AIe4yj1ZUW18RDhx6EPQKjwe7n8BbIecFtCQG4CfHGaHuh7fdfq+y3LIA2vGS/o9ZBGVxIDi9hw==", + "@esbuild/linux-arm@0.28.0": { + "integrity": "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw==", "os": ["linux"], "cpu": ["arm"] }, - "@esbuild/linux-ia32@0.27.2": { - "integrity": "sha512-MJt5BRRSScPDwG2hLelYhAAKh9imjHK5+NE/tvnRLbIqUWa+0E9N4WNMjmp/kXXPHZGqPLxggwVhz7QP8CTR8w==", + "@esbuild/linux-ia32@0.28.0": { + "integrity": "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ==", "os": ["linux"], "cpu": ["ia32"] }, - "@esbuild/linux-loong64@0.27.2": { - "integrity": "sha512-lugyF1atnAT463aO6KPshVCJK5NgRnU4yb3FUumyVz+cGvZbontBgzeGFO1nF+dPueHD367a2ZXe1NtUkAjOtg==", + "@esbuild/linux-loong64@0.28.0": { + "integrity": "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg==", "os": ["linux"], "cpu": ["loong64"] }, - "@esbuild/linux-mips64el@0.27.2": { - "integrity": "sha512-nlP2I6ArEBewvJ2gjrrkESEZkB5mIoaTswuqNFRv/WYd+ATtUpe9Y09RnJvgvdag7he0OWgEZWhviS1OTOKixw==", + "@esbuild/linux-mips64el@0.28.0": { + "integrity": "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w==", "os": ["linux"], "cpu": ["mips64el"] }, - "@esbuild/linux-ppc64@0.27.2": { - "integrity": "sha512-C92gnpey7tUQONqg1n6dKVbx3vphKtTHJaNG2Ok9lGwbZil6DrfyecMsp9CrmXGQJmZ7iiVXvvZH6Ml5hL6XdQ==", + "@esbuild/linux-ppc64@0.28.0": { + "integrity": "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg==", "os": ["linux"], "cpu": ["ppc64"] }, - "@esbuild/linux-riscv64@0.27.2": { - "integrity": "sha512-B5BOmojNtUyN8AXlK0QJyvjEZkWwy/FKvakkTDCziX95AowLZKR6aCDhG7LeF7uMCXEJqwa8Bejz5LTPYm8AvA==", + "@esbuild/linux-riscv64@0.28.0": { + "integrity": "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ==", "os": ["linux"], "cpu": ["riscv64"] }, - "@esbuild/linux-s390x@0.27.2": { - "integrity": "sha512-p4bm9+wsPwup5Z8f4EpfN63qNagQ47Ua2znaqGH6bqLlmJ4bx97Y9JdqxgGZ6Y8xVTixUnEkoKSHcpRlDnNr5w==", + "@esbuild/linux-s390x@0.28.0": { + "integrity": "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q==", "os": ["linux"], "cpu": ["s390x"] }, - "@esbuild/linux-x64@0.27.2": { - "integrity": "sha512-uwp2Tip5aPmH+NRUwTcfLb+W32WXjpFejTIOWZFw/v7/KnpCDKG66u4DLcurQpiYTiYwQ9B7KOeMJvLCu/OvbA==", + "@esbuild/linux-x64@0.28.0": { + "integrity": "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ==", "os": ["linux"], "cpu": ["x64"] }, - "@esbuild/netbsd-arm64@0.27.2": { - "integrity": "sha512-Kj6DiBlwXrPsCRDeRvGAUb/LNrBASrfqAIok+xB0LxK8CHqxZ037viF13ugfsIpePH93mX7xfJp97cyDuTZ3cw==", + "@esbuild/netbsd-arm64@0.28.0": { + "integrity": "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw==", "os": ["netbsd"], "cpu": ["arm64"] }, - "@esbuild/netbsd-x64@0.27.2": { - "integrity": "sha512-HwGDZ0VLVBY3Y+Nw0JexZy9o/nUAWq9MlV7cahpaXKW6TOzfVno3y3/M8Ga8u8Yr7GldLOov27xiCnqRZf0tCA==", + "@esbuild/netbsd-x64@0.28.0": { + "integrity": "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw==", "os": ["netbsd"], "cpu": ["x64"] }, - "@esbuild/openbsd-arm64@0.27.2": { - "integrity": "sha512-DNIHH2BPQ5551A7oSHD0CKbwIA/Ox7+78/AWkbS5QoRzaqlev2uFayfSxq68EkonB+IKjiuxBFoV8ESJy8bOHA==", + "@esbuild/openbsd-arm64@0.28.0": { + "integrity": "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g==", "os": ["openbsd"], "cpu": ["arm64"] }, - "@esbuild/openbsd-x64@0.27.2": { - "integrity": "sha512-/it7w9Nb7+0KFIzjalNJVR5bOzA9Vay+yIPLVHfIQYG/j+j9VTH84aNB8ExGKPU4AzfaEvN9/V4HV+F+vo8OEg==", + "@esbuild/openbsd-x64@0.28.0": { + "integrity": "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA==", "os": ["openbsd"], "cpu": ["x64"] }, - "@esbuild/openharmony-arm64@0.27.2": { - "integrity": "sha512-LRBbCmiU51IXfeXk59csuX/aSaToeG7w48nMwA6049Y4J4+VbWALAuXcs+qcD04rHDuSCSRKdmY63sruDS5qag==", + "@esbuild/openharmony-arm64@0.28.0": { + "integrity": "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w==", "os": ["openharmony"], "cpu": ["arm64"] }, - "@esbuild/sunos-x64@0.27.2": { - "integrity": "sha512-kMtx1yqJHTmqaqHPAzKCAkDaKsffmXkPHThSfRwZGyuqyIeBvf08KSsYXl+abf5HDAPMJIPnbBfXvP2ZC2TfHg==", + "@esbuild/sunos-x64@0.28.0": { + "integrity": "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw==", "os": ["sunos"], "cpu": ["x64"] }, - "@esbuild/win32-arm64@0.27.2": { - "integrity": "sha512-Yaf78O/B3Kkh+nKABUF++bvJv5Ijoy9AN1ww904rOXZFLWVc5OLOfL56W+C8F9xn5JQZa3UX6m+IktJnIb1Jjg==", + "@esbuild/win32-arm64@0.28.0": { + "integrity": "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA==", "os": ["win32"], "cpu": ["arm64"] }, - "@esbuild/win32-ia32@0.27.2": { - "integrity": "sha512-Iuws0kxo4yusk7sw70Xa2E2imZU5HoixzxfGCdxwBdhiDgt9vX9VUCBhqcwY7/uh//78A1hMkkROMJq9l27oLQ==", + "@esbuild/win32-ia32@0.28.0": { + "integrity": "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA==", "os": ["win32"], "cpu": ["ia32"] }, - "@esbuild/win32-x64@0.27.2": { - "integrity": "sha512-sRdU18mcKf7F+YgheI/zGf5alZatMUTKj/jNS6l744f9u3WFu4v7twcUI9vu4mknF4Y9aDlblIie0IM+5xxaqQ==", + "@esbuild/win32-x64@0.28.0": { + "integrity": "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw==", + "os": ["win32"], + "cpu": ["x64"] + }, + "@typescript/typescript-aix-ppc64@7.0.2": { + "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==", + "os": ["aix"], + "cpu": ["ppc64"] + }, + "@typescript/typescript-darwin-arm64@7.0.2": { + "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==", + "os": ["darwin"], + "cpu": ["arm64"] + }, + "@typescript/typescript-darwin-x64@7.0.2": { + "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==", + "os": ["darwin"], + "cpu": ["x64"] + }, + "@typescript/typescript-freebsd-arm64@7.0.2": { + "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==", + "os": ["freebsd"], + "cpu": ["arm64"] + }, + "@typescript/typescript-freebsd-x64@7.0.2": { + "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==", + "os": ["freebsd"], + "cpu": ["x64"] + }, + "@typescript/typescript-linux-arm64@7.0.2": { + "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==", + "os": ["linux"], + "cpu": ["arm64"] + }, + "@typescript/typescript-linux-arm@7.0.2": { + "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==", + "os": ["linux"], + "cpu": ["arm"] + }, + "@typescript/typescript-linux-loong64@7.0.2": { + "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==", + "os": ["linux"], + "cpu": ["loong64"] + }, + "@typescript/typescript-linux-mips64el@7.0.2": { + "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==", + "os": ["linux"], + "cpu": ["mips64el"] + }, + "@typescript/typescript-linux-ppc64@7.0.2": { + "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==", + "os": ["linux"], + "cpu": ["ppc64"] + }, + "@typescript/typescript-linux-riscv64@7.0.2": { + "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==", + "os": ["linux"], + "cpu": ["riscv64"] + }, + "@typescript/typescript-linux-s390x@7.0.2": { + "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==", + "os": ["linux"], + "cpu": ["s390x"] + }, + "@typescript/typescript-linux-x64@7.0.2": { + "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==", + "os": ["linux"], + "cpu": ["x64"] + }, + "@typescript/typescript-netbsd-arm64@7.0.2": { + "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==", + "os": ["netbsd"], + "cpu": ["arm64"] + }, + "@typescript/typescript-netbsd-x64@7.0.2": { + "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==", + "os": ["netbsd"], + "cpu": ["x64"] + }, + "@typescript/typescript-openbsd-arm64@7.0.2": { + "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==", + "os": ["openbsd"], + "cpu": ["arm64"] + }, + "@typescript/typescript-openbsd-x64@7.0.2": { + "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==", + "os": ["openbsd"], + "cpu": ["x64"] + }, + "@typescript/typescript-sunos-x64@7.0.2": { + "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==", + "os": ["sunos"], + "cpu": ["x64"] + }, + "@typescript/typescript-win32-arm64@7.0.2": { + "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==", + "os": ["win32"], + "cpu": ["arm64"] + }, + "@typescript/typescript-win32-x64@7.0.2": { + "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==", "os": ["win32"], "cpu": ["x64"] }, @@ -299,8 +390,8 @@ "entities@4.5.0": { "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==" }, - "esbuild@0.27.2": { - "integrity": "sha512-HyNQImnsOC7X9PMNaCIeAm4ISCQXs5a5YasTXVliKv4uuBo1dKrG0A+uQS8M5eXjVMnLg3WgXaKvprHlFJQffw==", + "esbuild@0.28.0": { + "integrity": "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw==", "optionalDependencies": [ "@esbuild/aix-ppc64", "@esbuild/android-arm", @@ -341,8 +432,8 @@ "json-schema-traverse@1.0.0": { "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==" }, - "lightningcss-wasm@1.30.2": { - "integrity": "sha512-3QB24h07oFTwiXI/wItgEv5De1prsmrZFWluuTyLO7/CFk4kEC5zgG7V6qQNGLBB5+QhSnGMixUALWHXj+J3Ug==" + "lightningcss-wasm@1.32.0": { + "integrity": "sha512-SteAkCtRuSCDYPGHKhLV/dDs5Bk+7I4QUxWxfk4xwsTI1rQk8MQyYtpGcd3NECsUGzK0q2/KqoVS+YHCqKHUTQ==" }, "linkify-it@5.0.2": { "integrity": "sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q==", @@ -350,8 +441,8 @@ "uc.micro" ] }, - "markdown-it-attrs@4.3.1_markdown-it@14.1.0": { - "integrity": "sha512-/ko6cba+H6gdZ0DOw7BbNMZtfuJTRp9g/IrGIuz8lYc/EfnmWRpaR3CFPnNbVz0LDvF8Gf1hFGPqrQqq7De0rg==", + "markdown-it-attrs@4.5.0_markdown-it@14.1.1": { + "integrity": "sha512-dsuEyK/MDAYsdZLDIaDAQXz5+gP0AAbJ4ZjOSB0w+ZGe4lLbzyCgGg0LApC6j9zUK2F+2SA9VkzXfyNG9hL/8g==", "dependencies": [ "markdown-it" ] @@ -359,8 +450,8 @@ "markdown-it-deflist@3.0.0": { "integrity": "sha512-OxPmQ/keJZwbubjiQWOvKLHwpV2wZ5I3Smc81OjhwbfJsjdRrvD5aLTQxmZzzePeO0kbGzAo3Krk4QLgA8PWLg==" }, - "markdown-it@14.1.0": { - "integrity": "sha512-a54IwgWPaeBCAAsv13YgmALOF1elABB08FxO9i+r4VFk5Vl4pKokRPeX8u5TCgSsPi6ec1otfLjdOpVcgbpshg==", + "markdown-it@14.1.1": { + "integrity": "sha512-BuU2qnTti9YKgK5N+IeMubp14ZUKUUw7yeJbkjtosvHiP0AZ5c8IAgEMk79D0eC8F23r4Ac/q8cAIFdm2FtyoA==", "dependencies": [ "argparse", "entities", @@ -377,14 +468,49 @@ "punycode.js@2.3.1": { "integrity": "sha512-uxFIHU0YlHYhDQtV4R9J6a52SLx28BCjT+4ieh7IGbgwVJWO+km431c4yRlREUAsAmt/uMjQUyQHNEPf0M39CA==" }, - "remove-markdown@0.6.2": { - "integrity": "sha512-EijDXJZbzpGbQBd852ViUzcqgpMujthM+SAEHiWCMcZonRbZ+xViWKLJA/vrwbDwYdxrs1aFDjpBhcGrZoJRGA==" + "remove-markdown@0.6.4": { + "integrity": "sha512-BompiLClzjfh46irZmzv+1Q61jZYlKN3iq/hzae9EOUwf7ctr/5wpD4qwgn/FWDAYE18RORO7z/yr+HXZJCY8Q==" }, "require-from-string@2.0.2": { "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==" }, - "schema-dts@1.1.5": { - "integrity": "sha512-RJr9EaCmsLzBX2NDiO5Z3ux2BVosNZN5jo0gWgsyKvxKIUL5R3swNvoorulAeL9kLB0iTSX7V6aokhla2m7xbg==" + "schema-dts-lib@1.0.0_typescript@7.0.2": { + "integrity": "sha512-9MEO5vpQH9JdBioUupqluzxSYxPLjhmqRUudk15adUl/ypnRsM2/M1kN3AmVJQeG7nZqcL68H8JlGqQQT6vy9A==", + "dependencies": [ + "typescript" + ] + }, + "schema-dts@2.0.0_typescript@7.0.2": { + "integrity": "sha512-t7NoCy3Rn5GHGx6p7s1qIYK/AeIb8ZxJNR9WUNFkwMv2CiiGZBmqqYWc2FlZVm5ZbiHMY4OvBWhj7QtyrFO2Jw==", + "dependencies": [ + "schema-dts-lib" + ] + }, + "typescript@7.0.2": { + "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==", + "optionalDependencies": [ + "@typescript/typescript-aix-ppc64", + "@typescript/typescript-darwin-arm64", + "@typescript/typescript-darwin-x64", + "@typescript/typescript-freebsd-arm64", + "@typescript/typescript-freebsd-x64", + "@typescript/typescript-linux-arm", + "@typescript/typescript-linux-arm64", + "@typescript/typescript-linux-loong64", + "@typescript/typescript-linux-mips64el", + "@typescript/typescript-linux-ppc64", + "@typescript/typescript-linux-riscv64", + "@typescript/typescript-linux-s390x", + "@typescript/typescript-linux-x64", + "@typescript/typescript-netbsd-arm64", + "@typescript/typescript-netbsd-x64", + "@typescript/typescript-openbsd-arm64", + "@typescript/typescript-openbsd-x64", + "@typescript/typescript-sunos-x64", + "@typescript/typescript-win32-arm64", + "@typescript/typescript-win32-x64" + ], + "bin": true }, "uc.micro@2.1.0": { "integrity": "sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A==" @@ -425,31 +551,30 @@ "https://cdn.jsdelivr.net/gh/b-fuze/deno-dom@0.1.56/src/dom/utils-types.ts": "96db30e3e4a75b194201bb9fa30988215da7f91b380fca6a5143e51ece2a8436", "https://cdn.jsdelivr.net/gh/b-fuze/deno-dom@0.1.56/src/dom/utils.ts": "bc429635e9204051ba1ecc1b212031b5ee7c6bcd95120c91bef696804aa67e74", "https://cdn.jsdelivr.net/gh/b-fuze/deno-dom@0.1.56/src/parser.ts": "e06b2300d693e6ae7564e53dfa5c9a9e97fdb8c044c39c52c8b93b5d60860be3", - "https://cdn.jsdelivr.net/gh/lumeland/bar@0.1.14/types.ts": "38f3714e1432c174009495333972f85fb306eb6313112ac8830fda9f1f47e87f", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/core/environment.ts": "140076e560d4d6e3ab8ecfee28fd10909d9c0f680138129a908a61076b52f768", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/core/errors.ts": "8606b682b465d598a394feea135dd2f84033b5ef2a61a23d116ccb782a0a547a", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/core/js.ts": "83084240150d7e8b83e43ec8fcf78564a8ba8599c3d517976efbb11b208903b2", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/core/reserved.ts": "e3ccafb4e5524b9c51fa14fa0e4bf17fd9bdd791848f17afa2aeb97835c486d1", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/core/tokenizer.ts": "460faa3de0e561e5046c46528c8bcbfc46b9de576af7ec8c4a8954a61a80ec76", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/loaders/file.ts": "83f579ac39838642bb45c6ddf48c05c08134cdd95fa7364d004fb443e972196a", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/mod.ts": "26081287509a87d81c51917795ff94ea80056c43599af8140bb5f666f0aaa767", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/auto_trim.ts": "5df5091763543493dba1160f805652c67892d3ecf06293bbfecdac71ed3c7d90", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/default.ts": "bab4f1f3e38a6ea3673d6aaa8409ca79ec241daa07a18582b4f2549cc5532200", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/echo.ts": "26109b7d47d33621dd764136be665052a48b3e68aeda2bd961504702f14c829f", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/empty.ts": "901df5c44bf0355a7b57819c1e565067de15a4f64fcd72e42904b1b5dc8314c5", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/escape.ts": "1db6eb7b22f88bbf94d21636c9b156ec4868e10bbcfa7dc5eae7113c36ef7b8a", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/export.ts": "c1f25c8e1e35027cc21e780f8fb3961febec4771463eb262959fbf035b8b8a63", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/for.ts": "a893a3de2c5cab43d5018cb80718ea46377c172d550e7a8ead076f00c58d59bf", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/function.ts": "472bdbe0bffb7d38c59003b02510cf85a78a35927219bc6a02ac2d4fde8b6597", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/if.ts": "db13776a5b9e7988f65c27943c344bec7463c5f3162a06cc4da1a313d7109195", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/import.ts": "b6fb6cc922c0897d15918d10766bbbd51069336780acdc8bbf23922ed870a1b3", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/include.ts": "7b39ae093e4c25f0de5f0b174c00c06c30bf7092b55f00a58a64968fa8ceabde", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/js.ts": "f5a7fd8cc48cb1b1dc0b396e3d1fee4664cf28932dc5f5f301e38243e0e987dc", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/layout.ts": "9c90bb58cc5302af48b97320f8eb128b37bb29f6128d7a75c8dd7b6625b870e1", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/mod.ts": "3ec79e54f145484db2459047789564ca98099bd5887b8768d6e223a7227d6172", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/set.ts": "cbe42b771a04203b6fc1c178e655fa2536ab90ae67e52c083cf7c71f37c62711", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/trim.ts": "8d33271327b09ffd8f569ebde85125b1324fa9538a54d6072ac97a9fb5d24264", - "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.0/plugins/unescape.ts": "1c56f0310c7757880df7684fc6b7bf9efd27fdb6b929b89626802f5a99cb93ee", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/core/environment.ts": "db44bd90da767fd35c735261badc5a060b581d0ef22231945d16ec0fea110d8b", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/core/errors.ts": "8606b682b465d598a394feea135dd2f84033b5ef2a61a23d116ccb782a0a547a", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/core/js.ts": "83084240150d7e8b83e43ec8fcf78564a8ba8599c3d517976efbb11b208903b2", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/core/reserved.ts": "e3ccafb4e5524b9c51fa14fa0e4bf17fd9bdd791848f17afa2aeb97835c486d1", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/core/tokenizer.ts": "460faa3de0e561e5046c46528c8bcbfc46b9de576af7ec8c4a8954a61a80ec76", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/loaders/file.ts": "83f579ac39838642bb45c6ddf48c05c08134cdd95fa7364d004fb443e972196a", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/mod.ts": "26081287509a87d81c51917795ff94ea80056c43599af8140bb5f666f0aaa767", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/auto_trim.ts": "5df5091763543493dba1160f805652c67892d3ecf06293bbfecdac71ed3c7d90", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/default.ts": "bab4f1f3e38a6ea3673d6aaa8409ca79ec241daa07a18582b4f2549cc5532200", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/echo.ts": "26109b7d47d33621dd764136be665052a48b3e68aeda2bd961504702f14c829f", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/empty.ts": "901df5c44bf0355a7b57819c1e565067de15a4f64fcd72e42904b1b5dc8314c5", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/escape.ts": "1db6eb7b22f88bbf94d21636c9b156ec4868e10bbcfa7dc5eae7113c36ef7b8a", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/export.ts": "40308665aeee8edeab4618d1838c1843c03cba8a7803ed9a27fceadf7a10bbef", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/for.ts": "a893a3de2c5cab43d5018cb80718ea46377c172d550e7a8ead076f00c58d59bf", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/function.ts": "472bdbe0bffb7d38c59003b02510cf85a78a35927219bc6a02ac2d4fde8b6597", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/if.ts": "db13776a5b9e7988f65c27943c344bec7463c5f3162a06cc4da1a313d7109195", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/import.ts": "b6fb6cc922c0897d15918d10766bbbd51069336780acdc8bbf23922ed870a1b3", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/include.ts": "7b39ae093e4c25f0de5f0b174c00c06c30bf7092b55f00a58a64968fa8ceabde", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/js.ts": "f5a7fd8cc48cb1b1dc0b396e3d1fee4664cf28932dc5f5f301e38243e0e987dc", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/layout.ts": "9c90bb58cc5302af48b97320f8eb128b37bb29f6128d7a75c8dd7b6625b870e1", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/mod.ts": "2bd756b503b1d100014fa02f92e2e8d07d894c6297358232a685c4a1527908c7", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/set.ts": "cbe42b771a04203b6fc1c178e655fa2536ab90ae67e52c083cf7c71f37c62711", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/trim.ts": "8d33271327b09ffd8f569ebde85125b1324fa9538a54d6072ac97a9fb5d24264", + "https://cdn.jsdelivr.net/gh/ventojs/vento@2.3.1/plugins/unescape.ts": "1c56f0310c7757880df7684fc6b7bf9efd27fdb6b929b89626802f5a99cb93ee", "https://deno.land/x/deno_dom@v0.1.56/build/deno-wasm/deno-wasm-dynamic.js": "fd05e83a855aa68b09396dc47a7638ef526c39917971715ac37e0fc3227db886", "https://deno.land/x/deno_dom@v0.1.56/build/deno-wasm/deno-wasm.js": "ccde5219e42040b8f7a8b653acc6c8cca197c29f98d6b75f74c48111e34bcbea", "https://deno.land/x/deno_dom@v0.1.56/build/deno-wasm/deno-wasm_bg-wasm.js": "52c57905a74047d1574f0b96e301ef1d5974cd962705615555b5e46b5ac420e4", @@ -478,92 +603,89 @@ "https://deno.land/x/deno_dom@v0.1.56/src/dom/utils-types.ts": "96db30e3e4a75b194201bb9fa30988215da7f91b380fca6a5143e51ece2a8436", "https://deno.land/x/deno_dom@v0.1.56/src/dom/utils.ts": "bc429635e9204051ba1ecc1b212031b5ee7c6bcd95120c91bef696804aa67e74", "https://deno.land/x/deno_dom@v0.1.56/src/parser.ts": "e06b2300d693e6ae7564e53dfa5c9a9e97fdb8c044c39c52c8b93b5d60860be3", - "https://deno.land/x/lume@v3.1.4/core/cache.ts": "bec945853a7111babf1fb465090d84dbf4176af0ad465b63b51031134ad6ea2a", - "https://deno.land/x/lume@v3.1.4/core/components.ts": "e5b0d2aca8e630735534a4cb781802fe9c194c3be4e1010c0abe73617c607d84", - "https://deno.land/x/lume@v3.1.4/core/data_loader.ts": "8698a9e9b1aac27147dc835ba89a0e30828c81338eceae86630607d78f146215", - "https://deno.land/x/lume@v3.1.4/core/debugbar.ts": "77d23362c29e69a8f42b8fc13d6129e62ac6ecf339bc0ac4739082c800b44f58", - "https://deno.land/x/lume@v3.1.4/core/events.ts": "e4fd1786eb7dd4a041d7d922779b9edf1ee89e51fd17ba5e756f380879ccb557", - "https://deno.land/x/lume@v3.1.4/core/file.ts": "5836010f28967a83fb02d721e78cfea1f2d125b4349204a8a3d04ac62070c127", - "https://deno.land/x/lume@v3.1.4/core/formats.ts": "e65130e5c5f2e49435619479710c812199b480a9e145fdc6b2bac11cfe6ea08e", - "https://deno.land/x/lume@v3.1.4/core/fs.ts": "ad0b1eb43361f76f36674505ef6b8870176ef386c43ee962e6c750506b40a071", - "https://deno.land/x/lume@v3.1.4/core/loaders/binary.ts": "bb1e1cf3faac49f6007dc6814168dc0f633da17356db18e68862e4b2a87a3f33", - "https://deno.land/x/lume@v3.1.4/core/loaders/json.ts": "ae28e711196215ca2772e9e31f2646ff4c3cf3f66ae75bf8cbcab94de5dbd24f", - "https://deno.land/x/lume@v3.1.4/core/loaders/module.ts": "abcb210fa6724b83407407cd0f7ef90462b35a2017bc135a3d124dd7f38843f6", - "https://deno.land/x/lume@v3.1.4/core/loaders/text.ts": "42860fc3482651fa6cfba18a734bb548d6e6e1163bf1015c2abc447ab150acbd", - "https://deno.land/x/lume@v3.1.4/core/loaders/toml.ts": "72ddfef2deea62815c28e27faa2c5356e09b3109e9547e47a6defea3d3332452", - "https://deno.land/x/lume@v3.1.4/core/loaders/yaml.ts": "241dc41fbe51b92e38dc748eda614c35d80fb8c63a6d40253453c6bb78c9c47e", - "https://deno.land/x/lume@v3.1.4/core/processors.ts": "047a87b0c9a0377ef15daaf1b671a29d541e4bb744c152f02a5c4f0a80fbbb64", - "https://deno.land/x/lume@v3.1.4/core/renderer.ts": "8c69046aa0fdc51fddbbd36c02aeb9b2226a5853f4ae8aeb549c17c43af13e88", - "https://deno.land/x/lume@v3.1.4/core/scopes.ts": "dbdf93d7a9cead84833779e974f190b1379356ec7c0ccd34aa92f917c2cdd2f9", - "https://deno.land/x/lume@v3.1.4/core/scripts.ts": "286969b120d2290ba57a7fdd9b37e587aacf4e4162d92f51f1f1e9e18c864f30", - "https://deno.land/x/lume@v3.1.4/core/searcher.ts": "580fd9a81c67ae33df416f80525a3dacbf49790ea7990a721f76719e15fa4878", - "https://deno.land/x/lume@v3.1.4/core/server.ts": "7b98b19422f69a17ed1877f4b6d38ce6b6228128064d88e9430a071846311cbc", - "https://deno.land/x/lume@v3.1.4/core/site.ts": "23aa4ebc11b0705608ed82a7743e3eb5102e4d00af6ee35c7a464b2b2aff813f", - "https://deno.land/x/lume@v3.1.4/core/source.ts": "d4dbe91058369ffaf23778da7e8d8287234f3901eed378accb7933e76529a216", - "https://deno.land/x/lume@v3.1.4/core/utils/cdn.ts": "5f7abfbff8b8a4d61b8eb520bfd77294066937ace2df5fc27451c09104190be4", - "https://deno.land/x/lume@v3.1.4/core/utils/cli_options.ts": "c1fd59592064e76ce71c4d65d7c0de6cafee836fbd8eb42717cc68f56ed36b8a", - "https://deno.land/x/lume@v3.1.4/core/utils/concurrent.ts": "cb0775b3d95f3faa356aa3a3e489dccef8807ed93cc4f84fcf5bc81e87c29504", - "https://deno.land/x/lume@v3.1.4/core/utils/data_values.ts": "589eb8299f7e767a10c2f2c4b9ef03ca9e79ba232b7f22fd151be9d1d68e1dc0", - "https://deno.land/x/lume@v3.1.4/core/utils/date.ts": "3eb0b0e2ea15a95cdfe737be70cd4f48cbe49401928cb04c25a230f411ab2478", - "https://deno.land/x/lume@v3.1.4/core/utils/digest.ts": "fcd15e7666fb28989b7d5b23c111044cfa71456fa39e26090ee88ac517ee4336", - "https://deno.land/x/lume@v3.1.4/core/utils/dom.ts": "fffb0c0c3ae613282e0447c3e4c122a62f44c776771d525a0ca09759883b4b9e", - "https://deno.land/x/lume@v3.1.4/core/utils/env.ts": "9d0d859303e8cb799d122088f077c54b85258763f2541313be3bf66b58ce33a3", - "https://deno.land/x/lume@v3.1.4/core/utils/format.ts": "bad71315eefd5ad0413841bbe5e8406d636d58d3ed3ef48674655b3a21a0aab0", - "https://deno.land/x/lume@v3.1.4/core/utils/generator.ts": "1e664e9fd4c469e38a0acf5c94fd49dac4f38cb6334563ea4b7fc498b5958877", - "https://deno.land/x/lume@v3.1.4/core/utils/log.ts": "9652d9b7a78fa61d667b6749a35ea02a00927b541d6d4d72e7f3de1881101bde", - "https://deno.land/x/lume@v3.1.4/core/utils/lume_version.ts": "c1c63818097e4a273183429ab5b2446a253307f7bc2d0d6361a17b4f230a617d", - "https://deno.land/x/lume@v3.1.4/core/utils/merge_data.ts": "8433920c7e66f27ae558777ed9add637f8c2f67adf9ca2c9ca60d566b9b3583f", - "https://deno.land/x/lume@v3.1.4/core/utils/net.ts": "d0d58c95668effc13669015c219295532f67e4a02396286308c772871b615a9b", - "https://deno.land/x/lume@v3.1.4/core/utils/object.ts": "9b2d1c20503137b612fcbb311b42d1f5500ae170b68f1dca43cc6b057423bc6e", - "https://deno.land/x/lume@v3.1.4/core/utils/page_content.ts": "bbadb588f9d9fcf1a2af156ce4b68974dfad39b65c3c8d42a6f1895b194c7eec", - "https://deno.land/x/lume@v3.1.4/core/utils/page_date.ts": "2a3d9c203df298ca61f568fdf509945f127f990769623c3edfd753d39807b757", - "https://deno.land/x/lume@v3.1.4/core/utils/page_url.ts": "e292cba024f66d35b1b622f9ac13e0910b0ed5ce12c368bd8014e03c1bb0b063", - "https://deno.land/x/lume@v3.1.4/core/utils/path.ts": "7a1d199113928cc35782aa3262cbe6f7a4894bc262d7d300de9385b3da45602f", - "https://deno.land/x/lume@v3.1.4/core/utils/read.ts": "9a0c87095be118bb599eeebba78613d5b3b1cf6c51c3b4c8016af45675bc7303", - "https://deno.land/x/lume@v3.1.4/core/utils/tokens.ts": "201777343e716403bfb1dbbc1a988a85b8d3f12699daaacbe8bbdc3c352a57ff", - "https://deno.land/x/lume@v3.1.4/core/watcher.ts": "9bdb33b2dac840b65545a894c6faecfd31064cc37852dc175081a2048548a89d", - "https://deno.land/x/lume@v3.1.4/core/writer.ts": "e8952538d57c0b587a3e9344b9b10d1b71274aca234b927b05a09c88ac3f4304", - "https://deno.land/x/lume@v3.1.4/deps/cli.ts": "1187f110934be0834f6f2699f4ec551a1cef54cca681bcb0a4eac2cab719ce80", - "https://deno.land/x/lume@v3.1.4/deps/colors.ts": "01c038ca4f8ad503ae0c81338223e3e9e1cbcaf0a14cc12bb6cd6c12f249df98", - "https://deno.land/x/lume@v3.1.4/deps/crypto.ts": "0939b1e974472d1db1d611b4160a5a51d796da1368289277d2e26803243959d5", - "https://deno.land/x/lume@v3.1.4/deps/debugbar.ts": "f5b87fc01d3c6b8861efa729b142de340f2ca3900b99c5d553434164b7e601d5", - "https://deno.land/x/lume@v3.1.4/deps/dom.ts": "08bdf42363093cae0e0a3f6efb3c500cfc8a7a6ab09d73fa69d212a6c907d547", - "https://deno.land/x/lume@v3.1.4/deps/esbuild.ts": "86718f7352e0a2b743c13453f1ed6d13c90802be9b4b53784ab2f44bf3af57bb", - "https://deno.land/x/lume@v3.1.4/deps/front_matter.ts": "f5e5780d4a0502d50cde1f42a4aa7830756dc9bd0251ba7448cecd1eaa60878f", - "https://deno.land/x/lume@v3.1.4/deps/fs.ts": "fe51c0a4d730977510f9c7d61ab119809935ab2e6daca80dca1d00b2159a59cb", - "https://deno.land/x/lume@v3.1.4/deps/hex.ts": "828718f24a780ff3ade8d0a8a5b57497cb31c257560ef12af99b6eb1a31e3bbd", - "https://deno.land/x/lume@v3.1.4/deps/http.ts": "d1c838a65168a9e496a47d7007e2635b3e436e7b0df03565386b6ad8ea6927fe", - "https://deno.land/x/lume@v3.1.4/deps/jsonc.ts": "79f0eddc3c9e593310eb8e5918eb1506b1c7d7816e4ecb96894f634ecbe626ff", - "https://deno.land/x/lume@v3.1.4/deps/lightningcss.ts": "9ae4e32c6b6854d5a2b955970a0f2143853511a329b275102423044b67c9c514", - "https://deno.land/x/lume@v3.1.4/deps/markdown_it.ts": "24c1c0fd18c99b9067d9ff5d051f934cb7c3446e6afbad934f6268af8d1ceb4d", - "https://deno.land/x/lume@v3.1.4/deps/path.ts": "a3d24ee31773ba6ef19b588612f376acef0ad5d3d761c4d9a315f79036cc87a4", - "https://deno.land/x/lume@v3.1.4/deps/remove-markdown.ts": "e304dcdd2c1042a1de5b2df53c9c8c39f4462307f95d13e4b2fa1ded26851013", - "https://deno.land/x/lume@v3.1.4/deps/schema-dts.ts": "cbf7506dba867d835e40fb2523d5f646ade1ff241166872734076ed5eff6a23f", - "https://deno.land/x/lume@v3.1.4/deps/semver.ts": "2002761250eb5e2ed7989c5a0e3ad637bb1bbb90adcfac9feae1c3aaa0c1eaf2", - "https://deno.land/x/lume@v3.1.4/deps/toml.ts": "151769d4382d8a4245e6d2e0ed5341a18216cdfc2b98c43fccaf5af957b47534", - "https://deno.land/x/lume@v3.1.4/deps/vento.ts": "154830128b1efcdfffc14290194b13a1a7346a23466365dc4751982d01afdd65", - "https://deno.land/x/lume@v3.1.4/deps/xml.ts": "3067678f3a9791bbd0fc14efe581e8be82c37b9b18bb0ec4eabf6a87769badea", - "https://deno.land/x/lume@v3.1.4/deps/yaml.ts": "ee79a110ac7f97ac7821792246ff29a9a4831d35ecc96f3dd543dc7a4ffd70c9", - "https://deno.land/x/lume@v3.1.4/middlewares/not_found.ts": "0f92cd91239444247a1c3dce1bed4e978445687ca76f544a0ccd483a352f761a", - "https://deno.land/x/lume@v3.1.4/mod.ts": "349b3b7fe199bc6703b1e1fb77f3ab92699fce966da2261d3419a951b1ef2c5d", - "https://deno.land/x/lume@v3.1.4/plugins/json.ts": "5c49499e56b919ec848d4118ec97dd4fe0a323a6cc4c648dc45ab55297614c12", - "https://deno.land/x/lume@v3.1.4/plugins/json_ld.ts": "a9643f94dd658a851ab664f712161899e2037fce39f30c167034016cf2142603", - "https://deno.land/x/lume@v3.1.4/plugins/markdown.ts": "7e82d897c1e35bf119dcd18b6aec7a6ba5aa06848897b34ff9cd161ec7c8757e", - "https://deno.land/x/lume@v3.1.4/plugins/metas.ts": "1e5826aadd5856af0c28a34e2f5580c718aa6cee6e7d7c63835e7c22467dc310", - "https://deno.land/x/lume@v3.1.4/plugins/modules.ts": "4e177c0ffe972b9deef10db2bf0ae52b405418af4dbac03db9e7ffbd6a3ec6ae", - "https://deno.land/x/lume@v3.1.4/plugins/paginate.ts": "6a1a9a24d0fabed2f722a6a6f29d98559219c69475685034181816e82d367f2e", - "https://deno.land/x/lume@v3.1.4/plugins/robots.ts": "8fe0e4aeba1b28d7f8e4810b1f8bc3f71e0fdb93b3108ebdcd4299e1ea66f18e", - "https://deno.land/x/lume@v3.1.4/plugins/search.ts": "5acb5be828bbbd012fb9226cb97ec3e370d43d05aa44d16e7e7d50bab368b442", - "https://deno.land/x/lume@v3.1.4/plugins/sitemap.ts": "bd6bcf783191ef60d364c0098b0c2f86d94c7cde7001beee6e8290b483f5944a", - "https://deno.land/x/lume@v3.1.4/plugins/toml.ts": "e5bf35ed4915587acd453f002b00ae9b88c1782cadc25c703d7642a390af43ea", - "https://deno.land/x/lume@v3.1.4/plugins/url.ts": "15f2e80b6fcbf86f8795a3676b8d533bab003ac016ff127e58165a6ac3bffc1a", - "https://deno.land/x/lume@v3.1.4/plugins/vento.ts": "56314afa125ebe85304f247dad6d18c6bcc7c882c77bb5ced1ca16430379e9e1", - "https://deno.land/x/lume@v3.1.4/plugins/yaml.ts": "d0ebf37c38648172c6b95c502753a3edf60278ab4f6a063f3ca00f31e0dd90cc", - "https://deno.land/x/xml@7.0.3/_types.ts": "203f97a91686f1aa9423ef07abe646da7caa07a2cf13b27897ffc4f43fdeae8f", - "https://deno.land/x/xml@7.0.3/mod.ts": "ca2bb5a9a90d236a2b6242c8643717e0c53f645092d2407792dad728e1367f9a", - "https://deno.land/x/xml@7.0.3/parse.ts": "8ae0d8339f589c29ab203dd7887e06325e2064efedfe9c61e2cd6d907443b664", - "https://deno.land/x/xml@7.0.3/stringify.ts": "f604d3d88b8bdaff11dbc9d57a6e98fd9b353e3bfbafcaa3f421e6b470ea0e02", - "https://deno.land/x/xml@7.0.3/wasm_xml_parser/wasm_xml_parser.js": "d2bc926dd852985fa0fc20b633073c9418ecbc558390368652e26ea97db92d8f" + "https://deno.land/x/lume@v3.2.5/core/cache.ts": "bec945853a7111babf1fb465090d84dbf4176af0ad465b63b51031134ad6ea2a", + "https://deno.land/x/lume@v3.2.5/core/components.ts": "549ffbcddbe5dbb05589e89c0e918799e13e32cd8f107f40be72b1cdd849732c", + "https://deno.land/x/lume@v3.2.5/core/data_loader.ts": "8698a9e9b1aac27147dc835ba89a0e30828c81338eceae86630607d78f146215", + "https://deno.land/x/lume@v3.2.5/core/debugbar.ts": "89f3ea8dcffd6b2333b8ff30eb1ef39f0c1ffc1857bf6e51f6d123fa1f8f109a", + "https://deno.land/x/lume@v3.2.5/core/events.ts": "e4fd1786eb7dd4a041d7d922779b9edf1ee89e51fd17ba5e756f380879ccb557", + "https://deno.land/x/lume@v3.2.5/core/file.ts": "4058ca45d07eb5940bddc6b0384df3dcac389ab7d3b2dca48f30ba75e196df1b", + "https://deno.land/x/lume@v3.2.5/core/formats.ts": "e65130e5c5f2e49435619479710c812199b480a9e145fdc6b2bac11cfe6ea08e", + "https://deno.land/x/lume@v3.2.5/core/fs.ts": "ad0b1eb43361f76f36674505ef6b8870176ef386c43ee962e6c750506b40a071", + "https://deno.land/x/lume@v3.2.5/core/loaders/binary.ts": "bb1e1cf3faac49f6007dc6814168dc0f633da17356db18e68862e4b2a87a3f33", + "https://deno.land/x/lume@v3.2.5/core/loaders/json.ts": "ae28e711196215ca2772e9e31f2646ff4c3cf3f66ae75bf8cbcab94de5dbd24f", + "https://deno.land/x/lume@v3.2.5/core/loaders/module.ts": "d2df9c49df5f8845f34c1363d48b8cfbcae4c9683201fd8513dd8db9933dca18", + "https://deno.land/x/lume@v3.2.5/core/loaders/text.ts": "42860fc3482651fa6cfba18a734bb548d6e6e1163bf1015c2abc447ab150acbd", + "https://deno.land/x/lume@v3.2.5/core/loaders/toml.ts": "72ddfef2deea62815c28e27faa2c5356e09b3109e9547e47a6defea3d3332452", + "https://deno.land/x/lume@v3.2.5/core/loaders/yaml.ts": "241dc41fbe51b92e38dc748eda614c35d80fb8c63a6d40253453c6bb78c9c47e", + "https://deno.land/x/lume@v3.2.5/core/processors.ts": "047a87b0c9a0377ef15daaf1b671a29d541e4bb744c152f02a5c4f0a80fbbb64", + "https://deno.land/x/lume@v3.2.5/core/renderer.ts": "ed142d18f74d24cf8710e47e13a6c12636a937a9c07d08a402a5f1ebb40d45cf", + "https://deno.land/x/lume@v3.2.5/core/scopes.ts": "dbdf93d7a9cead84833779e974f190b1379356ec7c0ccd34aa92f917c2cdd2f9", + "https://deno.land/x/lume@v3.2.5/core/scripts.ts": "286969b120d2290ba57a7fdd9b37e587aacf4e4162d92f51f1f1e9e18c864f30", + "https://deno.land/x/lume@v3.2.5/core/searcher.ts": "580fd9a81c67ae33df416f80525a3dacbf49790ea7990a721f76719e15fa4878", + "https://deno.land/x/lume@v3.2.5/core/server.ts": "7b98b19422f69a17ed1877f4b6d38ce6b6228128064d88e9430a071846311cbc", + "https://deno.land/x/lume@v3.2.5/core/site.ts": "33c8ea3eff51bf2f8941d801a161f73bda754e40a17b753e7538f42c92fdd9bd", + "https://deno.land/x/lume@v3.2.5/core/source.ts": "24ac00674f4beafdf01ba0e1c887bfceca4458c22e812e87edbfa02b9b450335", + "https://deno.land/x/lume@v3.2.5/core/utils/cdn.ts": "4309cb725106091d5d92a91f1599a6d5eacaaa5303fe7835ea27d55f97144e03", + "https://deno.land/x/lume@v3.2.5/core/utils/cli_options.ts": "88141f97850ff2e8e821dda6abed1f2d7993db2f1f23c8d6f2e6306eda094761", + "https://deno.land/x/lume@v3.2.5/core/utils/concurrent.ts": "f0172230b25d83aca497c64d92a08d9a373b9ffd13cf57c273a51d8a3a3a2a9e", + "https://deno.land/x/lume@v3.2.5/core/utils/data_values.ts": "589eb8299f7e767a10c2f2c4b9ef03ca9e79ba232b7f22fd151be9d1d68e1dc0", + "https://deno.land/x/lume@v3.2.5/core/utils/date.ts": "3eb0b0e2ea15a95cdfe737be70cd4f48cbe49401928cb04c25a230f411ab2478", + "https://deno.land/x/lume@v3.2.5/core/utils/digest.ts": "4835508be71ce719160eafbf29b9dcdf8180e341c0f2d704353f539bbf7c1641", + "https://deno.land/x/lume@v3.2.5/core/utils/dom.ts": "8337af56c8d447b5ad1b021a0981f9cec912dba820b2ba346820258b80b5f12a", + "https://deno.land/x/lume@v3.2.5/core/utils/env.ts": "0f2d7ab9c1c39727803e1b22abeb1d6d9798ec4e76cf85d213a01f5db42de978", + "https://deno.land/x/lume@v3.2.5/core/utils/format.ts": "bad71315eefd5ad0413841bbe5e8406d636d58d3ed3ef48674655b3a21a0aab0", + "https://deno.land/x/lume@v3.2.5/core/utils/generator.ts": "1e664e9fd4c469e38a0acf5c94fd49dac4f38cb6334563ea4b7fc498b5958877", + "https://deno.land/x/lume@v3.2.5/core/utils/log.ts": "d91930a4a08f0ccc9bdd8c82db3b76a39582e6913b34f4210bbe9cd8481ef478", + "https://deno.land/x/lume@v3.2.5/core/utils/lume_version.ts": "c1c63818097e4a273183429ab5b2446a253307f7bc2d0d6361a17b4f230a617d", + "https://deno.land/x/lume@v3.2.5/core/utils/merge_data.ts": "8433920c7e66f27ae558777ed9add637f8c2f67adf9ca2c9ca60d566b9b3583f", + "https://deno.land/x/lume@v3.2.5/core/utils/net.ts": "d0d58c95668effc13669015c219295532f67e4a02396286308c772871b615a9b", + "https://deno.land/x/lume@v3.2.5/core/utils/object.ts": "9b2d1c20503137b612fcbb311b42d1f5500ae170b68f1dca43cc6b057423bc6e", + "https://deno.land/x/lume@v3.2.5/core/utils/page_content.ts": "bbadb588f9d9fcf1a2af156ce4b68974dfad39b65c3c8d42a6f1895b194c7eec", + "https://deno.land/x/lume@v3.2.5/core/utils/page_date.ts": "2a3d9c203df298ca61f568fdf509945f127f990769623c3edfd753d39807b757", + "https://deno.land/x/lume@v3.2.5/core/utils/page_url.ts": "13d07d54c6d8db0b83df655de999909230d56267e69c0fbe849b4f38689dcecf", + "https://deno.land/x/lume@v3.2.5/core/utils/path.ts": "73db7b3bf8df81b7af4085a9fef4d5648ac083a4e826ae98c0dcb96b0fa64e6b", + "https://deno.land/x/lume@v3.2.5/core/utils/read.ts": "32010c32c2d99be0fd6ba2566f04a30c8b16f5d0c9eaee18ca80e472d5ab2644", + "https://deno.land/x/lume@v3.2.5/core/utils/tokens.ts": "7bb3731b4ee3232f38a6aec9c5364d7492b2ea4fcfe7321115a9af25a1ff2038", + "https://deno.land/x/lume@v3.2.5/core/watcher.ts": "f70b927c6bd54e213e53ca8b34ac47773cc0e34eccb3aa06c8697302c19c7de5", + "https://deno.land/x/lume@v3.2.5/core/writer.ts": "1c36d4a846dd4621b4b4d7aea56077dc43614400428ae3316390b2190e9fe1b5", + "https://deno.land/x/lume@v3.2.5/deps/cli.ts": "0cb49fc88dd6d699297f288d432562f20dde3e498f51993688ccf98f28c83d54", + "https://deno.land/x/lume@v3.2.5/deps/colors.ts": "eae71a8d83eb15ab20c140b94987a1c789e1ece31d99b3ec2841506eaff854bc", + "https://deno.land/x/lume@v3.2.5/deps/dom.ts": "08bdf42363093cae0e0a3f6efb3c500cfc8a7a6ab09d73fa69d212a6c907d547", + "https://deno.land/x/lume@v3.2.5/deps/esbuild.ts": "dcdff1214c796ab5c076b054a6aad586345e291bfc6cc9e5e464387aeb0544d6", + "https://deno.land/x/lume@v3.2.5/deps/front_matter.ts": "f5e5780d4a0502d50cde1f42a4aa7830756dc9bd0251ba7448cecd1eaa60878f", + "https://deno.land/x/lume@v3.2.5/deps/fs.ts": "976956b66a86d5ad001043e8ce92cbc08bb29eb6f7703c73eda99b05f49069d4", + "https://deno.land/x/lume@v3.2.5/deps/http.ts": "6fd6334e70a106201e1d5159d61d6b72b0cd907d6ab9c430a9ff6232bc4d19de", + "https://deno.land/x/lume@v3.2.5/deps/jsonc.ts": "abe9c7b88ded304adac6e1eec70a858ae5dcce95ca53d91bde425a2edf3a653d", + "https://deno.land/x/lume@v3.2.5/deps/lightningcss.ts": "18b9aa9bbd7c6d522f719dfb337502402c9916fd69826bc5f0c9d385ea4ba641", + "https://deno.land/x/lume@v3.2.5/deps/markdown_it.ts": "6045278bba08ed2fa0c384441d8fe60693cac2b85fd90321e8ce6d3e4408349a", + "https://deno.land/x/lume@v3.2.5/deps/path.ts": "173ff2317c7a2efefb79aa51e09a6b2a6618a705c802c7fe24c912a50afb0818", + "https://deno.land/x/lume@v3.2.5/deps/remove-markdown.ts": "3379ad9b35d20a80b70861a780bd3bc1fed986be3b5263bc1f9b615aa2e0423f", + "https://deno.land/x/lume@v3.2.5/deps/schema-dts.ts": "5e50d80ec367fc1df36b558657112053efaeae6ac276c1b911c0ee92bf814381", + "https://deno.land/x/lume@v3.2.5/deps/semver.ts": "4089dbcbad21636cb3d743eb61b3727674c133fba17556f0738b799f1a5a9441", + "https://deno.land/x/lume@v3.2.5/deps/toml.ts": "61831fd046e8df6b35ccdacc7fc3b3ae7c0a2450b2f368cf933e518d243b3881", + "https://deno.land/x/lume@v3.2.5/deps/vento.ts": "dda80130df3c9ae6ebc50ccc4ef81bbad548241058c45f702dfdcca811390ccc", + "https://deno.land/x/lume@v3.2.5/deps/xml.ts": "6655c2c6ace584db8db760481a730917823ca2c6ac1362fe8260385807cb368f", + "https://deno.land/x/lume@v3.2.5/deps/yaml.ts": "8c5a777049063cf15db6cf8814fd43ce6811469a800341f0cc9af962ef6110fe", + "https://deno.land/x/lume@v3.2.5/middlewares/not_found.ts": "0f92cd91239444247a1c3dce1bed4e978445687ca76f544a0ccd483a352f761a", + "https://deno.land/x/lume@v3.2.5/mod.ts": "349b3b7fe199bc6703b1e1fb77f3ab92699fce966da2261d3419a951b1ef2c5d", + "https://deno.land/x/lume@v3.2.5/plugins/json.ts": "5c49499e56b919ec848d4118ec97dd4fe0a323a6cc4c648dc45ab55297614c12", + "https://deno.land/x/lume@v3.2.5/plugins/json_ld.ts": "446ac77ff51bfbf6b12589838164ce59d6a5845ede94c97702f4e927a788f6ff", + "https://deno.land/x/lume@v3.2.5/plugins/markdown.ts": "7e82d897c1e35bf119dcd18b6aec7a6ba5aa06848897b34ff9cd161ec7c8757e", + "https://deno.land/x/lume@v3.2.5/plugins/metas.ts": "1e5826aadd5856af0c28a34e2f5580c718aa6cee6e7d7c63835e7c22467dc310", + "https://deno.land/x/lume@v3.2.5/plugins/modules.ts": "4e177c0ffe972b9deef10db2bf0ae52b405418af4dbac03db9e7ffbd6a3ec6ae", + "https://deno.land/x/lume@v3.2.5/plugins/paginate.ts": "5ed0524fc0a69eb75142abd2ade37d9ff8f1e31516fdafb7a3676532b5f2db63", + "https://deno.land/x/lume@v3.2.5/plugins/robots.ts": "66316f3fda2c5697c0ee862c8cb9927195dd7d4b8925e3fd6b3fb49fda5f97bd", + "https://deno.land/x/lume@v3.2.5/plugins/search.ts": "5acb5be828bbbd012fb9226cb97ec3e370d43d05aa44d16e7e7d50bab368b442", + "https://deno.land/x/lume@v3.2.5/plugins/sitemap.ts": "bc84ff724b1d85ebf56b68247fc25eb08702d03b2c0c82fd3c2e01983a6ec5e8", + "https://deno.land/x/lume@v3.2.5/plugins/toml.ts": "e5bf35ed4915587acd453f002b00ae9b88c1782cadc25c703d7642a390af43ea", + "https://deno.land/x/lume@v3.2.5/plugins/url.ts": "15f2e80b6fcbf86f8795a3676b8d533bab003ac016ff127e58165a6ac3bffc1a", + "https://deno.land/x/lume@v3.2.5/plugins/vento.ts": "11272f4de3a02e97e91ec31d9efd7568b74334352b141ff302844d8f309a225a", + "https://deno.land/x/lume@v3.2.5/plugins/yaml.ts": "d0ebf37c38648172c6b95c502753a3edf60278ab4f6a063f3ca00f31e0dd90cc", + "https://deno.land/x/xml@7.0.4/_types.ts": "203f97a91686f1aa9423ef07abe646da7caa07a2cf13b27897ffc4f43fdeae8f", + "https://deno.land/x/xml@7.0.4/mod.ts": "ca2bb5a9a90d236a2b6242c8643717e0c53f645092d2407792dad728e1367f9a", + "https://deno.land/x/xml@7.0.4/parse.ts": "8ae0d8339f589c29ab203dd7887e06325e2064efedfe9c61e2cd6d907443b664", + "https://deno.land/x/xml@7.0.4/stringify.ts": "f604d3d88b8bdaff11dbc9d57a6e98fd9b353e3bfbafcaa3f421e6b470ea0e02", + "https://deno.land/x/xml@7.0.4/wasm_xml_parser/wasm_xml_parser.js": "7a75f1be12625a3e7f8368b880aad3803d04dfc547c89236f3f4dde3813c5b36" }, "workspace": { "dependencies": [ From 88c9e668e57f124efe813e7ebc5262bf0229af50 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 03:28:04 +0000 Subject: [PATCH 4/5] deps: accept the last markdown-it advisory with an expiry, after rung 3 fails MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ninth and final finding on this repo. The other eight — including a CVSS 8.7 in linkify-it — were fixed at rungs 1 and 2 and are not accepted here. GHSA-6v5v-wf23-fmfq, markdown-it 14.1.1, fixed in 14.2.0, severity 5.3 (the lowest of the nine). RUNG 2 IS EXHAUSTED, not skipped. markdown-it is reached only through lume, whose deps/markdown_it.ts pins npm:markdown-it@14.1.1 EXACTLY. Read that file from v3.2.2, v3.2.4 and v3.2.5 — the newest published — and all three carry the same exact pin. RUNG 3 WAS ATTEMPTED AND DOES NOT APPLY. REMEDIATION.md says to promote the package to a direct import in deno.json so the resolver has no room to keep a stale transitive entry. Tried exactly that: "markdown-it": "npm:markdown-it@^14.2.0" and relocked. The lock still resolved markdown-it@14.1.1 and the npm entry count did not move (68 before, 68 after) — the mapping was inert. An import-map entry can only redirect a BARE specifier, and lume's is fully qualified, so there is nothing for the map to intercept; nothing in src/ imports markdown-it directly either. The dead mapping was reverted rather than committed, since a manifest diff that fixes no advisory is churn. That leaves this or vendoring lume, which is a far larger change than a 5.3 warrants. ignoreUntil = 2026-10-31, three months. Not decoration: osv-scanner fails closed once the date passes, so this expires on its own rather than becoming permanent by neglect. The reason field carries the exact command to re-check whether lume has moved, so whoever hits it next does not have to re-derive any of the above. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01LF9Cu8u4dkCEM8MXC1QeDL --- osv-scanner.toml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 osv-scanner.toml diff --git a/osv-scanner.toml b/osv-scanner.toml new file mode 100644 index 0000000..bea106d --- /dev/null +++ b/osv-scanner.toml @@ -0,0 +1,9 @@ +# Acceptances for the shared osv-scan lane. See ci-workflows/REMEDIATION.md. +# +# One entry. Everything else this repo was failing on (8 of 9 advisories, +# including a CVSS 8.7) was fixed at rungs 1 and 2 rather than accepted. + +[[IgnoredVulns]] +id = "GHSA-6v5v-wf23-fmfq" +ignoreUntil = 2026-10-31 +reason = "markdown-it 14.1.1, fixed in 14.2.0. Reached only through lume, whose deps/markdown_it.ts pins npm:markdown-it@14.1.1 EXACTLY — checked v3.2.2, v3.2.4 and v3.2.5, the newest published, and all three carry the same exact pin, so rung 2 is exhausted. Rung 3 was attempted and does not apply: promoting markdown-it to a direct import in deno.json leaves the lock resolving 14.1.1, because an import-map entry can only redirect a BARE specifier and lume's is fully qualified. Nothing in src/ imports markdown-it directly. Remaining options were this or vendoring lume. Severity 5.3, the lowest of the nine findings this lane surfaced here. REMOVE THIS when lume's deps/markdown_it.ts moves to >=14.2.0 — check with: curl -s https://deno.land/x/lume@/deps/markdown_it.ts | grep markdown-it, and get from https://cdn.deno.land/lume/meta/versions.json" From ba144709f38ea0ef7b9b62541f608a6a94a3356d Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 03:30:55 +0000 Subject: [PATCH 5/5] deps: accept the two remaining low advisories, both dated, both lume-pinned MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaces the single-entry acceptance with two, after the lume bump surfaced a second finding that the earlier commit could not have known about. GHSA-6v5v-wf23-fmfq markdown-it 14.1.1 fixed 14.2.0 5.3 GHSA-g7r4-m6w7-qqqr esbuild 0.28.0 fixed 0.28.1 2.5 The esbuild one was INTRODUCED BY THE LUME BUMP IN THIS PR. Saying so plainly because it is the kind of thing that otherwise looks like it was always there: the advisory's range is introduced 0.27.3 / fixed 0.28.1, and lume v3.1.4 pinned 0.27.2 — below the range by luck, not design. So the bump is a trade, not a free win, and the header comment records it: lume v3.1.4 markdown-it 14.1.0 (5.5 + 5.3) esbuild 0.27.2 (clean) 2 findings lume v3.2.5 markdown-it 14.1.1 (5.3) esbuild 0.28.0 (2.5) 2 findings Same count either way. v3.2.5 is kept because its worst is 5.3 rather than 5.5, and because the newest lume is where an upstream fix will actually land. v3.2.2 was checked as a possible sweet spot and is not one — it pins esbuild 0.27.3, already inside the affected range. Both entries fail rungs 1-3 for the same structural reason, which is now written down once and referenced twice: lume pins these packages with exact, fully-qualified npm specifiers, nothing in src/ imports them, and an import-map promotion can only redirect a BARE specifier. Verified, not assumed — the markdown-it promotion was actually attempted and left the lock unchanged at 68 npm entries. Both carry ignoreUntil 2026-10-31 and the exact curl to re-check whether lume has moved, so the next person does not re-derive any of this. osv-scanner fails closed when the date passes. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01LF9Cu8u4dkCEM8MXC1QeDL --- osv-scanner.toml | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/osv-scanner.toml b/osv-scanner.toml index bea106d..27d2bc4 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -1,9 +1,27 @@ # Acceptances for the shared osv-scan lane. See ci-workflows/REMEDIATION.md. # -# One entry. Everything else this repo was failing on (8 of 9 advisories, -# including a CVSS 8.7) was fixed at rungs 1 and 2 rather than accepted. +# Two entries, both reached only through lume's exact npm pins, both dated. +# Everything else this repo was failing on — 8 of 9 advisories, including a +# CVSS 8.7 in linkify-it — was FIXED at rungs 1 and 2, not accepted. +# +# On the lume version choice, because it is a trade and not a free win: +# +# lume v3.1.4 markdown-it 14.1.0 (5.5 + 5.3) esbuild 0.27.2 (clean) = 2 findings +# lume v3.2.5 markdown-it 14.1.1 (5.3) esbuild 0.28.0 (2.5) = 2 findings +# +# Bumping lume clears one markdown-it advisory and introduces the esbuild one, +# because the esbuild advisory was introduced in 0.27.3 and v3.1.4 happened to +# pin 0.27.2 — below the range by luck, not by design. Both versions leave two +# findings; v3.2.5 is kept because its worst is 5.3 rather than 5.5, and +# because sitting on the newest lume is where a real upstream fix will arrive. +# v3.2.2 was checked too and is no better: esbuild 0.27.3, already in range. [[IgnoredVulns]] id = "GHSA-6v5v-wf23-fmfq" ignoreUntil = 2026-10-31 -reason = "markdown-it 14.1.1, fixed in 14.2.0. Reached only through lume, whose deps/markdown_it.ts pins npm:markdown-it@14.1.1 EXACTLY — checked v3.2.2, v3.2.4 and v3.2.5, the newest published, and all three carry the same exact pin, so rung 2 is exhausted. Rung 3 was attempted and does not apply: promoting markdown-it to a direct import in deno.json leaves the lock resolving 14.1.1, because an import-map entry can only redirect a BARE specifier and lume's is fully qualified. Nothing in src/ imports markdown-it directly. Remaining options were this or vendoring lume. Severity 5.3, the lowest of the nine findings this lane surfaced here. REMOVE THIS when lume's deps/markdown_it.ts moves to >=14.2.0 — check with: curl -s https://deno.land/x/lume@/deps/markdown_it.ts | grep markdown-it, and get from https://cdn.deno.land/lume/meta/versions.json" +reason = "MARKDOWN-IT. 14.1.1, fixed in 14.2.0. Reached only through lume, whose deps/markdown_it.ts pins npm:markdown-it@14.1.1 EXACTLY — checked v3.2.2, v3.2.4 and v3.2.5, the newest published, and all three carry the same exact pin, so rung 2 is exhausted. Rung 3 was attempted and does not apply: promoting markdown-it to a direct import in deno.json leaves the lock resolving 14.1.1, because an import-map entry can only redirect a BARE specifier and lume's is fully qualified. Nothing in src/ imports markdown-it directly. Remaining options were this or vendoring lume. Severity 5.3, the lowest of the nine findings this lane surfaced here. REMOVE THIS when lume's deps/markdown_it.ts moves to >=14.2.0 — check with: curl -s https://deno.land/x/lume@/deps/markdown_it.ts | grep markdown-it, and get from https://cdn.deno.land/lume/meta/versions.json" + +[[IgnoredVulns]] +id = "GHSA-g7r4-m6w7-qqqr" +ignoreUntil = 2026-10-31 +reason = "ESBUILD. 0.28.0, affected range is introduced 0.27.3 / fixed 0.28.1 — so this is narrow, and no lume release pins inside the fixed window: v3.2.2 pins 0.27.3, v3.2.4 and v3.2.5 pin 0.28.0. Same exact-pin structure as the markdown-it entry above, so rungs 1-3 fail for the same reason: nothing in src/ imports esbuild, and an import-map entry cannot redirect lume's fully-qualified specifier. Introduced BY the lume v3.1.4 -> v3.2.5 bump in this PR, deliberately and with the trade recorded in the header comment. CVSS 2.5, and the vector is local with integrity-only impact (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) — it needs local access to a build host, which is a narrower exposure than the 8.7 this bump helped clear. REMOVE THIS when lume pins esbuild >=0.28.1 — check with: curl -s https://deno.land/x/lume@/deps/esbuild.ts | grep esbuild, and get from https://cdn.deno.land/lume/meta/versions.json"