From 0bab3193f0c7e059c7fef4904bb5cc67bfeb767b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 21:10:16 +0000 Subject: [PATCH 1/3] build(deps): Bump the python-dependencies group Bumps the python-dependencies group in /fp-cloud-cli with 3 updates: [typer](https://github.com/fastapi/typer), [click](https://github.com/pallets/click) and [posthog](https://github.com/posthog/posthog-python). Updates `typer` from 0.27.1 to 0.27.2 - [Release notes](https://github.com/fastapi/typer/releases) - [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md) - [Commits](https://github.com/fastapi/typer/compare/0.27.1...0.27.2) Updates `click` from 8.4.2 to 8.5.0 - [Release notes](https://github.com/pallets/click/releases) - [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md) - [Commits](https://github.com/pallets/click/compare/8.4.2...8.5.0) Updates `posthog` from 7.42.0 to 7.44.2 - [Release notes](https://github.com/posthog/posthog-python/releases) - [Changelog](https://github.com/PostHog/posthog-python/blob/main/CHANGELOG.md) - [Commits](https://github.com/posthog/posthog-python/compare/posthog-v7.42.0...posthog-v7.44.2) --- updated-dependencies: - dependency-name: typer dependency-version: 0.27.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: click dependency-version: 8.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: posthog dependency-version: 7.44.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] --- fp-cloud-cli/uv.lock | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/fp-cloud-cli/uv.lock b/fp-cloud-cli/uv.lock index ebd086ef..b5f1e9e8 100644 --- a/fp-cloud-cli/uv.lock +++ b/fp-cloud-cli/uv.lock @@ -208,14 +208,11 @@ wheels = [ [[package]] name = "click" -version = "8.4.2" +version = "8.5.0" source = { registry = "https://pypi.org/simple" } -dependencies = [ - { name = "colorama", marker = "sys_platform == 'win32'" }, -] -sdist = { url = "https://files.pythonhosted.org/packages/76/d4/81420972a676e8ffea40450d8c8c92943e7218a78fe9b64359836cc9876b/click-8.4.2.tar.gz", hash = "sha256:9a6cea6e60b17ebe0a44c5cc636d94f09bd66142c1cd7d8b4cd731c4917a15f6", size = 338000, upload-time = "2026-06-24T17:45:15.148Z" } +sdist = { url = "https://files.pythonhosted.org/packages/c7/0e/7fa0ef50764b67090eca4114772a2abf8b6148198475e54c660b97caeee6/click-8.5.0.tar.gz", hash = "sha256:ba0d2089de75ea0310e2dde03160e6ca10009947fb95a182f9b54021bb272e34", size = 382235, upload-time = "2026-08-26T13:33:14.56Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/fb/e2/79c688af8b210d232694e31e59da9f6ec747bae31c3f5946e4e9b98860d5/click-8.4.2-py3-none-any.whl", hash = "sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76", size = 119243, upload-time = "2026-06-24T17:45:13.73Z" }, + { url = "https://files.pythonhosted.org/packages/58/50/6c0d534c5f134586a8e1ba4e330569e32f057e33372ae556463212fb4cd3/click-8.5.0-py3-none-any.whl", hash = "sha256:255bc9599cf7748b4b1a446ccc735421bd08a2ae529a8b88597d3de5664ee360", size = 125251, upload-time = "2026-08-26T13:33:12.928Z" }, ] [[package]] @@ -375,7 +372,7 @@ wheels = [ [[package]] name = "posthog" -version = "7.42.0" +version = "7.44.2" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "backoff" }, @@ -383,9 +380,9 @@ dependencies = [ { name = "requests" }, { name = "typing-extensions" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/79/97/32cc0a72d7896cc2d27d442c75c9d24cc77d0140be9f5e98df7f4ce98f6a/posthog-7.42.0.tar.gz", hash = "sha256:c7e9297446208d413c3071348f101f4c05e32fba4228ac0a85e9d0014c2a274e", size = 469662, upload-time = "2026-08-21T12:57:15.05Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e4/04/7aef5b358b5627086ba9643b32f7616aab8c07d6be829a1dcfc4424d317a/posthog-7.44.2.tar.gz", hash = "sha256:e375172bfaad5c7cfa25c027bc3b9db2794cd94f3845d13b0b51108bdfe80a3b", size = 480055, upload-time = "2026-08-27T08:06:51.238Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/31/f0/46e28b947a19c992ad7289931d3197358cfdf4980b33317b5e7cf9c24abe/posthog-7.42.0-py3-none-any.whl", hash = "sha256:6429c9a4145572a8f54ab00330bbfe987340025d3a464212505be814b2b0950d", size = 559119, upload-time = "2026-08-21T12:57:13.299Z" }, + { url = "https://files.pythonhosted.org/packages/7b/ce/17f7050afd08facdede145321be581425999b1e067c3cde7147fb7a8b89c/posthog-7.44.2-py3-none-any.whl", hash = "sha256:4a3d4b7c994d0b2d43a05b03293ce9a652900a5143d79fbeedb2f2fa78048ad3", size = 567692, upload-time = "2026-08-27T08:06:49.505Z" }, ] [[package]] @@ -520,7 +517,7 @@ wheels = [ [[package]] name = "typer" -version = "0.27.1" +version = "0.27.2" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "annotated-doc" }, @@ -528,9 +525,9 @@ dependencies = [ { name = "rich" }, { name = "shellingham" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/ae/40/4a3db7990d1f62a53182aa96eaef57aeb2886a27f90a195bc66713565d31/typer-0.27.1.tar.gz", hash = "sha256:a79bef8469a79c45498e7b814ecf8d603cc7644e9acbd9e19cac0334240b18df", size = 203994, upload-time = "2026-08-03T14:41:03.438Z" } +sdist = { url = "https://files.pythonhosted.org/packages/16/f7/57713ba479fd405eb76de31404b2c744c289e336b2d999511ebf51e496f7/typer-0.27.2.tar.gz", hash = "sha256:269b7eb9d3c202ca84b4bc9618cb04ebb43d3d4d1e567e4c768607232c05f945", size = 204045, upload-time = "2026-08-28T10:26:55.046Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/43/89/9518bc0c3929bee36b3a4a8e3daddd6e03f92f9961c66d4983b837160543/typer-0.27.1-py3-none-any.whl", hash = "sha256:53150287edd11baeb4e4722c8e394fcdf8181c0ae89485cba8d25c778d5edd56", size = 122874, upload-time = "2026-08-03T14:41:04.391Z" }, + { url = "https://files.pythonhosted.org/packages/dc/bf/205d0004930ede8f542fb58f601526fccf4ae7626075ca1e6c4de5d3d652/typer-0.27.2-py3-none-any.whl", hash = "sha256:b3a5fc4342d5fc8fda8fc3010b1cf117e9249aab7fae800c2eff62fd3842d97d", size = 123130, upload-time = "2026-08-28T10:26:53.752Z" }, ] [[package]] From 2b90da0edbd6ddce9bc38726670a2ccae19763b9 Mon Sep 17 00:00:00 2001 From: NiveditJain Date: Wed, 2 Sep 2026 12:26:04 +0530 Subject: [PATCH 2/3] fix(fp-cloud-cli): resolve each Click symbol separately, so one move cannot rebind them all MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit typer 0.27.2 moved `Abort` out of its vendored `typer._click.exceptions` into a plain `typer.exceptions.Abort(RuntimeError)`. `_click_compat` imported all six of its symbols under one `try: … except ImportError: from click import …`, so that single missing name sent the whole block to the fallback and bound `ClickException`, `UsageError`, `BadParameter`, `Command` and `Parameter` to the pip `click` distribution — which is not the Click Typer runs, and Typer catches only its own. Every typed error then escaped its handler: `fp alerts show ghost` exited 1 with an empty stderr instead of 6 with `no alert named "ghost"`, and likewise for exits 2, 3, 4 and 5. 105 tests went red on this PR's bump — the first one to install 0.27.2 — and nothing else warned, because the CLI still imported and every happy path still passed. This is precisely the failure mode the module's own docstring describes; it just had one all-or-nothing `except ImportError` standing between the two Clicks. Pick the Click ONCE, on whether `typer._click` exists at all, then import every symbol from that choice. A name that later goes missing inside the chosen Click now raises at import — a CLI that refuses to start — instead of silently flattening the exit-code contract to 1. `Abort` is the one symbol not pinned to a Click at all: it comes from `typer.Abort`, which tracks the move by construction (pip Click's before typer 0.26, the vendored class through 0.27.1, `typer.exceptions.Abort` from 0.27.2) and is by definition the class `typer.prompt` raises and typer's own `_main` catches — the only property `select.py`'s `except click.Abort` needs. `test_click_compat.py` gains three alarms for the partial miss the old shape swallowed: every symbol's provenance asserted separately, `Abort` pinned to `typer.Abort`, and the hand-raised `UsageError`/`BadParameter` checked end to end for exit 2. All three fail against the previous `_click_compat` and pass against this one. Suite verified green against typer 0.25.1, 0.27.0, 0.27.1 and 0.27.2 (915 passed); 0.13.0 and 0.26.0 have the same pre-existing failures before and after, untouched by this change. Wheel build, `fp --version`, `fp help` and a real typed-error exit (4, message on stderr) verified from a clean install of the built wheel. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01VZSRsXYbse5cDU3iancJKq --- CHANGELOG.md | 10 +++++ fp-cloud-cli/CHANGELOG.md | 29 +++++++++++-- fp-cloud-cli/fp_cli/_click_compat.py | 39 ++++++++++++++---- fp-cloud-cli/pyproject.toml | 11 ++++- fp-cloud-cli/tests/test_click_compat.py | 54 +++++++++++++++++++++++++ 5 files changed, 130 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9db82aee..210d29b7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,15 @@ # Changelog +## 1.0.4-beta.0 — 2026-09-02 + +### Fixes + +- `fp-cloud-cli`'s Click shim survives typer 0.27.2, which moved `Abort` out of its vendored Click. `_click_compat` wrapped all six vendored imports in one `try: … except ImportError: from click import …`, so that single missing name rebound **every** symbol to pip Click — the exact silent failure the module exists to prevent. Typer catches only its own Click's exceptions, so every typed error escaped uncaught: `fp alerts show ghost` exited 1 with an empty stderr instead of 6 with a message, and the same for exits 2, 3, 4 and 5. 105 tests went red on the dependabot bump that first installed 0.27.2. The Click is now chosen once — on whether `typer._click` exists at all — and each symbol imported from that choice, so a name that goes missing raises at import (a CLI that will not start) rather than silently downgrading every error to exit 1. `Abort` alone is resolved from `typer.Abort`, which tracks the move by construction: pip Click's before typer 0.26, the vendored class through 0.27.1, `typer.exceptions.Abort` from 0.27.2 (#771) + +### Dependencies + +- `fp-cloud-cli`: typer 0.27.1 → 0.27.2, click 8.4.2 → 8.5.0, posthog 7.42.0 → 7.44.2 (#771) + ## 1.0.3 — 2026-08-31 One user-facing fix, and the three suite fixes that were needed to see it. diff --git a/fp-cloud-cli/CHANGELOG.md b/fp-cloud-cli/CHANGELOG.md index cc26deba..27fd628e 100644 --- a/fp-cloud-cli/CHANGELOG.md +++ b/fp-cloud-cli/CHANGELOG.md @@ -3,9 +3,32 @@ ## 0.0.1b2 — 2026-08-25 Open for the next release. `0.0.1b1` published on 2026-08-24 and the `bump` job -moved the version here automatically; nothing has landed against `0.0.1b2` yet. -Add entries as changes merge — this section becomes the GitHub Release body when -it ships. +moved the version here automatically. Add entries as changes merge — this section +becomes the GitHub Release body when it ships. + +### Fixes + +- **Typed errors keep their exit codes under typer 0.27.2.** That release moved + `Abort` out of its vendored `typer._click.exceptions`, and `_click_compat` + imported all six of its symbols under a single + `try: … except ImportError: from click import …`. One missing name was enough + to send the whole block to the fallback, binding `ClickException`, + `UsageError`, `BadParameter`, `Command` and `Parameter` to the pip `click` + distribution — which is *not* the Click Typer runs, and Typer catches only its + own. So every typed error escaped its handler: `fp alerts show ghost` exited + **1 with an empty stderr** instead of **6** with `no alert named "ghost"`, and + likewise for exits 2, 3, 4 and 5. Nothing warned; the CLI imported and every + happy path passed. The Click is now decided **once**, on whether `typer._click` + exists at all, and every symbol imported from that decision, so a future move + fails at import — a CLI that refuses to start — instead of silently flattening + the exit-code contract. `Abort` is resolved from `typer.Abort`, which is by + construction the class `typer.prompt` raises and typer's own `_main` catches on + every version in range. Suite verified green against typer 0.25.1, 0.27.0, + 0.27.1 and 0.27.2 (#771) + +### Dependencies + +- typer 0.27.1 → 0.27.2, click 8.4.2 → 8.5.0, posthog 7.42.0 → 7.44.2 (#771) ## 0.0.1b1 — 2026-08-24 diff --git a/fp-cloud-cli/fp_cli/_click_compat.py b/fp-cloud-cli/fp_cli/_click_compat.py index e8091a00..bcffadb9 100644 --- a/fp-cloud-cli/fp_cli/_click_compat.py +++ b/fp-cloud-cli/fp_cli/_click_compat.py @@ -11,9 +11,10 @@ should print ``✗ …`` and exit 5 exits **1 with an empty stderr**, and the ``rich_format_error`` hook in ``app.py`` (reached only *after* that catch) never runs. Same for the ``UsageError``/``BadParameter`` we raise by hand. -* ``Abort`` — ``typer.prompt`` raises its own Click's ``Abort`` on closed stdin, so a - pip-Click ``except click.Abort`` stops matching and the clean "no TTY, pass a slug" - usage error becomes a bare abort. +* ``Abort`` — ``typer.prompt`` raises the ``Abort`` **typer** exports on closed stdin + (0.27.2 moved that class out of the vendored Click entirely), so a pip-Click + ``except click.Abort`` stops matching and the clean "no TTY, pass a slug" usage error + becomes a bare abort. * Options — Typer 0.26+ has no ``Option`` class in its vendored Click *at all*: every option in a Typer-built tree is a ``typer.core.TyperOption``, subclassing ``Parameter`` directly. ``isinstance(param, click.Option)`` is then quietly always @@ -27,14 +28,36 @@ from __future__ import annotations +# `Abort` is resolved from `typer` itself rather than from either Click, because it is +# the one symbol here that is not stably a Click class: typer 0.27.2 moved it out of the +# vendored `typer._click.exceptions` into a plain `typer.exceptions.Abort(RuntimeError)`. +# `typer.Abort` tracks that move — it is `click.Abort` before 0.26, the vendored class +# through 0.27.1, the RuntimeError from 0.27.2 — and it is by construction the class +# `typer.prompt` raises and typer's own `_main` catches, which is the only property +# `select.py`'s `except click.Abort` needs. +from typer import Abort as Abort + +# Pick the Click ONCE, on whether typer vendors one at all, then import every symbol +# from that choice. Deciding per symbol — a single `try` around the whole vendored +# import block, falling back to pip `click` on any ImportError — is what shipped +# through 0.27.1 and it failed exactly as silently as this module exists to prevent: +# 0.27.2 removing `typer._click.exceptions.Abort` made that one missing name rebind ALL +# SIX symbols to pip Click, so every typed error escaped Typer's handler as exit 1 with +# an empty stderr. A name that goes missing inside the chosen Click must raise here, at +# import, where it is a CLI that refuses to start rather than one that silently stops +# reporting errors. try: - # typer >= 0.26. pip `click` may well still be installed — it is simply not the - # Click in play, so binding to it here would reintroduce the whole class of bug. - from typer._click import ClickException, Command, Parameter - from typer._click.exceptions import Abort, BadParameter, UsageError + import typer._click as _typer_click # typer >= 0.26 vendors its own Click except ImportError: # typer < 0.26 drives the pip `click` distribution directly + _typer_click = None # type: ignore[assignment] + +if _typer_click is not None: + # pip `click` may well still be installed — it is simply not the Click in play, so + # binding to it here would reintroduce the whole class of bug. + from typer._click import ClickException, Command, Parameter + from typer._click.exceptions import BadParameter, UsageError +else: from click import ( # type: ignore[assignment] - Abort, BadParameter, ClickException, Command, diff --git a/fp-cloud-cli/pyproject.toml b/fp-cloud-cli/pyproject.toml index 4872bb6e..cbf6b8f0 100644 --- a/fp-cloud-cli/pyproject.toml +++ b/fp-cloud-cli/pyproject.toml @@ -31,7 +31,14 @@ dependencies = [ # through that — which is what makes both sides of the split work. Import Click from # there and nowhere else; `tests/test_click_compat.py` enforces it, because every way # this breaks is silent (typed errors collapse to exit 1 with an empty stderr, and the - # telemetry flag catalog empties). Suite verified against 0.25.1 and 0.27.0. + # telemetry flag catalog empties). Suite verified against 0.25.1, 0.27.0, 0.27.1 and + # 0.27.2. + # + # The split keeps moving INSIDE the vendored tree, so the shim resolves each symbol + # separately: 0.27.2 moved `Abort` out of `typer._click.exceptions` into + # `typer.exceptions`, and the one all-or-nothing `try/except ImportError` that used to + # wrap the vendored import sent every OTHER symbol to pip Click over that single + # missing name — 105 tests red, every typed error at exit 1. # # The floor is 0.13, not 0.12, because 0.12 cannot BUILD this app: the global # `--insecure/--secure` option in `app.py` is an `Optional[bool]` with a @@ -39,7 +46,7 @@ dependencies = [ # rejects with `TypeError: Secondary flag is not valid for non-boolean flag`. # That fires while the command tree is constructed, before any parsing, so # `fp --version`, `fp --help` and every subcommand die identically — an - # installed CLI that cannot run one command. `uv.lock` pins 0.27.1, so + # installed CLI that cannot run one command. `uv.lock` pins 0.27.2, so # neither CI nor the publish smoke test ever installed the broken part of the # range. Measured across 0.12.0/0.12.3/0.12.5 (all fail) and 0.13.0 upward # (all pass). diff --git a/fp-cloud-cli/tests/test_click_compat.py b/fp-cloud-cli/tests/test_click_compat.py index 488bd842..ea88dd6f 100644 --- a/fp-cloud-cli/tests/test_click_compat.py +++ b/fp-cloud-cli/tests/test_click_compat.py @@ -11,6 +11,7 @@ import ast import pathlib +import pytest import typer from typer.testing import CliRunner @@ -95,6 +96,59 @@ def test_error_exit_codes_are_distinct_per_class(): assert issubclass(KeyModeUnsupportedError, _click_compat.ClickException) +def test_every_symbol_comes_from_the_click_typer_runs(): + """No symbol may quietly come from pip Click while Typer is running its own. + + This is the alarm for a *partial* miss. `_click_compat` used to wrap the whole + vendored import in one `try: … except ImportError: from click import …`, so a single + name disappearing from `typer._click` rebound **all six** symbols to pip Click — and + that is not hypothetical: typer 0.27.2 moved `Abort` out of + `typer._click.exceptions`, and the fallback fired, and 105 tests went red at once + with typed errors collapsing to exit 1. Assert the provenance of each symbol + separately, so the next move is one failure naming one symbol. + """ + typer_click = pytest.importorskip( + "typer._click", reason="typer < 0.26 has no vendored Click; pip click IS the right one" + ) + wrong = { + name: obj.__module__ + for name in ("ClickException", "UsageError", "BadParameter", "Command", "Parameter") + if not (obj := getattr(_click_compat, name)).__module__.startswith(typer_click.__name__) + } + assert not wrong, f"these came from pip Click, not the Click Typer runs: {wrong}" + + +def test_abort_is_the_one_typer_raises(): + """`Abort` is the exception NOT to pin to a Click — pin it to Typer. + + It is `click.Abort` before typer 0.26, the vendored class through 0.27.1, and a + plain `typer.exceptions.Abort(RuntimeError)` from 0.27.2 on. `typer.Abort` is the + class `typer.prompt` raises and typer's own `_main` catches on every one of those, + which is the only thing `select.py`'s `except click.Abort` needs to be true. + """ + assert _click_compat.Abort is typer.Abort + + +def test_hand_raised_usage_errors_reach_typers_handler(): + """The other half of the contract: `UsageError`/`BadParameter` we raise ourselves. + + `test_typed_errors_reach_typers_handler` covers the `ClickException` subclasses in + `errors.py`; these two are raised directly through the shim (`raise + click.UsageError(...)`) from a dozen call sites, and bound to the wrong Click they + escape uncaught the same way — exit 1, empty stderr, instead of a clean exit 2. + """ + for exc_class in (_click_compat.UsageError, _click_compat.BadParameter): + app = typer.Typer() + + @app.command() + def boom() -> None: + raise exc_class("bad input") + + result = CliRunner().invoke(app, []) + assert result.exit_code == 2, (exc_class, result.output) + assert "bad input" in result.output + + def test_is_option_recognises_typer_options(): """Typer's vendored Click has no `Option` class, so `isinstance` cannot answer this. From 948f60b8d05b6b22f0fc3c6373ef4d29204b889b Mon Sep 17 00:00:00 2001 From: NiveditJain Date: Wed, 2 Sep 2026 12:32:33 +0530 Subject: [PATCH 3/3] fix(deps): pin browserslist to 4.28.8, closing two 7.5 advisories in bun.lock MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GHSA-73wf-gq98-2v4g and GHSA-c83g-rgw3-j3cx are both against browserslist 4.28.2 and both fixed in 4.28.7, so the Supply Chain gate blocks on them correctly — "2 vulnerabilities can be fixed". They turned `main` red on its own scheduled run this morning (33591233694), not on anything a PR changed: the advisories were disclosed after this branch's first CI run, which is the same surface-late mechanism osv-scanner.toml already describes for chromadb. browserslist is transitive-only, reached through `@babel/helper-compilation- targets`'s `^4.24.0`, so this is an `overrides` pin rather than a dependency bump — which is what osv-scanner.toml's own header prescribes ("Always prefer FIXING (bump the dependency, or pin it via `overrides` in package.json) over ignoring"), and what the seven pins already in that block are. `bun update browserslist` is NOT the fix and was reverted: it adds browserslist to `dependencies` as a direct dep it is not, and it leaves 4.28.2 in the tree nested under `@babel/helper-compilation-targets/browserslist`, so the gate stays red for the same two advisories. The override collapses the tree to exactly one browserslist, at 4.28.8. Diff is browserslist and its own dependency set only. Verified: `bun run build`, `bun run lint` (0 errors), `bunx tsc --noEmit` clean, `bun run test:run` 4856 passed. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01VZSRsXYbse5cDU3iancJKq --- CHANGELOG.md | 2 ++ bun.lock | 13 +++++++++---- package.json | 3 ++- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 210d29b7..1d4108d1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,8 @@ - `fp-cloud-cli`: typer 0.27.1 → 0.27.2, click 8.4.2 → 8.5.0, posthog 7.42.0 → 7.44.2 (#771) +- browserslist pinned to 4.28.8 in `overrides`, closing GHSA-73wf-gq98-2v4g and GHSA-c83g-rgw3-j3cx (both 7.5, both fixed in 4.28.7). They turned `main` red on its own scheduled Supply Chain run rather than on any PR's change — disclosed after this branch's first CI run, the same surface-late mechanism `osv-scanner.toml` documents for chromadb. browserslist is transitive-only (via `@babel/helper-compilation-targets`'s `^4.24.0`), so this is an override pin, not a dependency bump — and not `bun update browserslist`, which adds it to `dependencies` as a direct dep it is not and leaves 4.28.2 nested under `@babel/helper-compilation-targets`, keeping the gate red (#771) + ## 1.0.3 — 2026-08-31 One user-facing fix, and the three suite fixes that were needed to see it. diff --git a/bun.lock b/bun.lock index 3312d169..510efbdb 100644 --- a/bun.lock +++ b/bun.lock @@ -39,6 +39,7 @@ }, "overrides": { "brace-expansion": "5.0.9", + "browserslist": "4.28.8", "eslint-plugin-react-hooks": "7.0.1", "nanoid": "3.3.18", "postcss": "8.5.26", @@ -493,7 +494,7 @@ "braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="], - "browserslist": ["browserslist@4.28.2", "", { "dependencies": { "baseline-browser-mapping": "^2.10.12", "caniuse-lite": "^1.0.30001782", "electron-to-chromium": "^1.5.328", "node-releases": "^2.0.36", "update-browserslist-db": "^1.2.3" }, "bin": { "browserslist": "cli.js" } }, "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg=="], + "browserslist": ["browserslist@4.28.8", "", { "dependencies": { "baseline-browser-mapping": "^2.11.12", "caniuse-lite": "^1.0.30001809", "electron-to-chromium": "^1.5.402", "node-releases": "^2.0.53", "update-browserslist-db": "^1.3.0" }, "bin": { "browserslist": "cli.js" } }, "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA=="], "call-bind": ["call-bind@1.0.9", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "es-define-property": "^1.0.1", "get-intrinsic": "^1.3.0", "set-function-length": "^1.2.2" } }, "sha512-a/hy+pNsFUTR+Iz8TCJvXudKVLAnz/DyeSUo10I5yvFDQJBFU2s9uqQpoSrJlroHUKoKqzg+epxyP9lqFdzfBQ=="], @@ -567,7 +568,7 @@ "dunder-proto": ["dunder-proto@1.0.1", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.1", "es-errors": "^1.3.0", "gopd": "^1.2.0" } }, "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A=="], - "electron-to-chromium": ["electron-to-chromium@1.5.363", "", {}, "sha512-VjUKPyWzGnT1fujlkEGC/BvN70Hh70KXtAqcmniXviYlJC/ivcT+BWGPyxWVbJZLfvtKR6dqg1L7T7pgAMBtWA=="], + "electron-to-chromium": ["electron-to-chromium@1.5.420", "", {}, "sha512-2yD6XreGusOfNV+dUcvipJEXc3n/n7fgr7996aszTG+YY5E4mqM4tOq/3uhP129cazL9YHbVWSpc79ePotWtPA=="], "emoji-regex": ["emoji-regex@9.2.2", "", {}, "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="], @@ -981,7 +982,7 @@ "node-exports-info": ["node-exports-info@1.6.0", "", { "dependencies": { "array.prototype.flatmap": "^1.3.3", "es-errors": "^1.3.0", "object.entries": "^1.1.9", "semver": "^6.3.1" } }, "sha512-pyFS63ptit/P5WqUkt+UUfe+4oevH+bFeIiPPdfb0pFeYEu/1ELnJu5l+5EcTKYL5M7zaAa7S8ddywgXypqKCw=="], - "node-releases": ["node-releases@2.0.46", "", {}, "sha512-GYVXHE2KnrzAfsAjl4uP++evGFCrAU1jta4ubEjIG7YWt/64Gqv66a30yKwWczVjA6j3bM4nBwH7Pk1JmDHaxQ=="], + "node-releases": ["node-releases@2.0.54", "", {}, "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ=="], "object-assign": ["object-assign@4.1.1", "", {}, "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg=="], @@ -1235,7 +1236,7 @@ "unrs-resolver": ["unrs-resolver@1.12.2", "", { "dependencies": { "napi-postinstall": "^0.3.4" }, "optionalDependencies": { "@unrs/resolver-binding-android-arm-eabi": "1.12.2", "@unrs/resolver-binding-android-arm64": "1.12.2", "@unrs/resolver-binding-darwin-arm64": "1.12.2", "@unrs/resolver-binding-darwin-x64": "1.12.2", "@unrs/resolver-binding-freebsd-x64": "1.12.2", "@unrs/resolver-binding-linux-arm-gnueabihf": "1.12.2", "@unrs/resolver-binding-linux-arm-musleabihf": "1.12.2", "@unrs/resolver-binding-linux-arm64-gnu": "1.12.2", "@unrs/resolver-binding-linux-arm64-musl": "1.12.2", "@unrs/resolver-binding-linux-loong64-gnu": "1.12.2", "@unrs/resolver-binding-linux-loong64-musl": "1.12.2", "@unrs/resolver-binding-linux-ppc64-gnu": "1.12.2", "@unrs/resolver-binding-linux-riscv64-gnu": "1.12.2", "@unrs/resolver-binding-linux-riscv64-musl": "1.12.2", "@unrs/resolver-binding-linux-s390x-gnu": "1.12.2", "@unrs/resolver-binding-linux-x64-gnu": "1.12.2", "@unrs/resolver-binding-linux-x64-musl": "1.12.2", "@unrs/resolver-binding-openharmony-arm64": "1.12.2", "@unrs/resolver-binding-wasm32-wasi": "1.12.2", "@unrs/resolver-binding-win32-arm64-msvc": "1.12.2", "@unrs/resolver-binding-win32-ia32-msvc": "1.12.2", "@unrs/resolver-binding-win32-x64-msvc": "1.12.2" } }, "sha512-dmlRxBJJayXjqTwC+JtF1HhJmgf3ftQ3YejFcZrf4+KKtJv0qDsK1pjqaaVjG7wJ5NJ6UVP1OqRMQ71Z4C3rxQ=="], - "update-browserslist-db": ["update-browserslist-db@1.2.3", "", { "dependencies": { "escalade": "^3.2.0", "picocolors": "^1.1.1" }, "peerDependencies": { "browserslist": ">= 4.21.0" }, "bin": { "update-browserslist-db": "cli.js" } }, "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w=="], + "update-browserslist-db": ["update-browserslist-db@1.3.2", "", { "dependencies": { "escalade": "^3.2.0", "picocolors": "^1.1.1" }, "peerDependencies": { "browserslist": ">= 4.21.0" }, "bin": { "update-browserslist-db": "cli.js" } }, "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw=="], "uri-js": ["uri-js@4.4.1", "", { "dependencies": { "punycode": "^2.1.0" } }, "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg=="], @@ -1317,6 +1318,10 @@ "@typescript-eslint/typescript-estree/tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="], + "browserslist/baseline-browser-mapping": ["baseline-browser-mapping@2.11.20", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw=="], + + "browserslist/caniuse-lite": ["caniuse-lite@1.0.30001810", "", {}, "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg=="], + "data-urls/whatwg-url": ["whatwg-url@16.0.1", "", { "dependencies": { "@exodus/bytes": "^1.11.0", "tr46": "^6.0.0", "webidl-conversions": "^8.0.1" } }, "sha512-1to4zXBxmXHV3IiSSEInrreIlu02vUOvrhxJJH5vcxYTBDAx51cqZiKdyTxlecdKNSjj8EcxGBxNf6Vg+945gw=="], "eslint-import-resolver-node/debug": ["debug@3.2.7", "", { "dependencies": { "ms": "^2.1.1" } }, "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ=="], diff --git a/package.json b/package.json index f5b4d75a..ac481e27 100644 --- a/package.json +++ b/package.json @@ -117,6 +117,7 @@ "vite": "8.0.16", "undici": "7.29.0", "brace-expansion": "5.0.9", - "sharp": "0.35.0" + "sharp": "0.35.0", + "browserslist": "4.28.8" } }