Skip to content

Fix/image CVE refresh #744

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wdower merged 7 commits into from
Jul 31, 2026
Merged

Fix/image CVE refresh #744

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
007edca
fix(security): remediate shipped-image gem CVEs + ECI build fixes
wdower Jul 28, 2026
67663fb
chore: remove giant comment from Gemfile
wdower Jul 28, 2026
272177a
fix(ci): sync Ruby/Node version pins to 3.4.10 for CVE patch
wdower Jul 29, 2026
d219bbb
ci: build Ruby from source for lint/backend (ruby-builder lacks 3.4.10)
wdower Jul 30, 2026
ffa5bc9
fix(deps): bump bootsnap to 1.24.6 for Ruby 3.4.10 boot under coverage
wdower Jul 30, 2026
3acb4ff
fix(security): bump Rails to 8.0.5.1 for CVE-2026-66066
wdower Jul 30, 2026
e21fd91
harden: enforce HTTPS on build-time curl downloads (Sonar S6506)
wdower Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 20 additions & 13 deletions .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,22 @@
/sonar-project.properties
/postcss.config.js

# Ignore additional dev/CI/internal files not needed at runtime
/.claude
/.foreman
/.git-hooks
/.gitguardian.yml
/.github_changelog_generator
/.rspec
/.safety-net.json
/.slugignore
/.sonarcloud.properties
/.tool-versions
/app.json
/cliff.toml
/issues.jsonl
/Procfile.dev

# Ignore non-Linux binaries
/bin/vulcan

Expand All @@ -81,20 +97,11 @@
/nginx.conf*
/setup-docker-secrets.sh

# Ignore markdown files not needed at runtime
/CHANGELOG.md
/CODE_OF_CONDUCT.md
/CONTRIBUTING.md
/LICENSE.md
/NOTICE.md
/README.md
/RELEASE_NOTES.md
/SECURITY.md
/ROADMAP.md
/BENCHMARK-VIEWER-DESIGN.md
# Ignore root-level markdown (docs/ is kept — read at runtime by DisaGuideController)
/*.md

# Other root files not needed at runtime
/AGENT-STATUS
/ENVIRONMENT_VARIABLES.md
/CLAUDE.md
/_config.yml
/CNAME
/create_admin.rb
26 changes: 12 additions & 14 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,16 +16,18 @@
# docker buildx build --platform linux/amd64,linux/arm64 --target production -t vulcan:prod .
# =============================================================================

ARG RUBY_VERSION=3.4.9
ARG RUBY_VERSION=3.4.10
# Upstream SHA256 from https://www.ruby-lang.org/en/news/<release>/
ARG RUBY_SHA256=7bb4d4f5e807cc27251d14d9d6086d182c5b25875191e44ab15b709cd7a7dd9c
# 3.4.10 (2026-06-30) ships default gem erb 4.0.4.1 (CVE-2026-41316) and
# net-imap 0.5.15 (CVE-2026-4224x) — clears the ruby-layer default-gem findings.
ARG RUBY_SHA256=ecee2d072a14f2d14347dd56dfd8fe5c3130abf5117bfaacbda0f4ef9cc429ec
ARG BUNDLER_VERSION=2.7.2
ARG NODE_VERSION=24.14.0
ARG NODE_VERSION=24.18.0

# =============================================================================
# BASE STAGE - Common foundation for all stages
# =============================================================================
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7 AS base
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7@sha256:907b68736aa798b2d38255b7aa070b2a70acb90803864a40f05d0ec47556ddd0 AS base

Check warning on line 30 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use either the version tag or the digest for the image instead of both. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_D&open=AZ-nD54j7Nsapz3kwv_D&pullRequest=744

USER 0

Expand Down Expand Up @@ -115,32 +117,32 @@
# findutils, tar, xz are kept here (build-time only) and intentionally
# excluded from the base stage — they're not needed at runtime.

RUN curl -fsSL https://cache.ruby-lang.org/pub/ruby/${RUBY_VERSION%.*}/ruby-${RUBY_VERSION}.tar.gz -o /tmp/ruby.tar.gz && \

Check warning on line 120 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_F&open=AZ-nD54j7Nsapz3kwv_F&pullRequest=744

Check warning on line 120 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Surround this variable with double quotes; otherwise, it can lead to unexpected behavior. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_H&open=AZ-nD54j7Nsapz3kwv_H&pullRequest=744

Check warning on line 120 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Replace this invocation of "curl" with the ADD instruction. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_E&open=AZ-nD54j7Nsapz3kwv_E&pullRequest=744

Check warning on line 120 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Surround this variable with double quotes; otherwise, it can lead to unexpected behavior. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_G&open=AZ-nD54j7Nsapz3kwv_G&pullRequest=744
echo "${RUBY_SHA256} /tmp/ruby.tar.gz" | sha256sum -c - && \
tar -xzf /tmp/ruby.tar.gz -C /tmp && \
tar --no-same-owner -xzf /tmp/ruby.tar.gz -C /tmp && \
cd /tmp/ruby-${RUBY_VERSION} && \

Check warning on line 123 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Surround this variable with double quotes; otherwise, it can lead to unexpected behavior. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_I&open=AZ-nD54j7Nsapz3kwv_I&pullRequest=744
./configure --prefix=/usr/local \
--disable-install-doc \
--enable-yjit && \
make -j"$(nproc)" && \
make install && \
gem update --system --no-document && \
gem install bundler:${BUNDLER_VERSION} --no-document && \

Check warning on line 130 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Surround this variable with double quotes; otherwise, it can lead to unexpected behavior. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_J&open=AZ-nD54j7Nsapz3kwv_J&pullRequest=744
chown -R 1000:0 /usr/local/bundle && \
chmod -R g=u /usr/local/bundle && \
cd /tmp && \
rm -rf /tmp/ruby-${RUBY_VERSION} /tmp/ruby.tar.gz && \

Check warning on line 134 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Surround this variable with double quotes; otherwise, it can lead to unexpected behavior. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_K&open=AZ-nD54j7Nsapz3kwv_K&pullRequest=744
ruby --version && \
bundle --version

# jemalloc — UBI doesn't ship it; compile from source for ~20-30% memory savings.
ARG JEMALLOC_VERSION=5.3.0
ARG JEMALLOC_SHA256=2db82d1e7119df3e71b7640219b6dfe84789bc0537983c3b7ac4f7189aecfeaa
RUN curl -fsSL https://github.com/jemalloc/jemalloc/releases/download/${JEMALLOC_VERSION}/jemalloc-${JEMALLOC_VERSION}.tar.bz2 \

Check warning on line 141 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Surround this variable with double quotes; otherwise, it can lead to unexpected behavior. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_N&open=AZ-nD54j7Nsapz3kwv_N&pullRequest=744

Check warning on line 141 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_M&open=AZ-nD54j7Nsapz3kwv_M&pullRequest=744

Check warning on line 141 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Surround this variable with double quotes; otherwise, it can lead to unexpected behavior. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_O&open=AZ-nD54j7Nsapz3kwv_O&pullRequest=744
-o /tmp/jemalloc.tar.bz2 && \

Check warning on line 142 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Replace this invocation of "curl" with the ADD instruction. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_L&open=AZ-nD54j7Nsapz3kwv_L&pullRequest=744
echo "${JEMALLOC_SHA256} /tmp/jemalloc.tar.bz2" | sha256sum -c - && \
tar -xjf /tmp/jemalloc.tar.bz2 -C /tmp && \
tar --no-same-owner -xjf /tmp/jemalloc.tar.bz2 -C /tmp && \
cd /tmp/jemalloc-${JEMALLOC_VERSION} && \

Check warning on line 145 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Surround this variable with double quotes; otherwise, it can lead to unexpected behavior. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_P&open=AZ-nD54j7Nsapz3kwv_P&pullRequest=744
./configure --prefix=/usr/local && \
make -j"$(nproc)" && \
make install && \
Expand All @@ -155,11 +157,11 @@
ENV PATH="/opt/node/bin:${PATH}"
RUN ARCH=$([ "$TARGETARCH" = "amd64" ] && echo "x64" || echo "arm64") && \
NODE_TARBALL="node-v${NODE_VERSION}-linux-${ARCH}.tar.xz" && \
curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/${NODE_TARBALL}" -o /tmp/node.tar.xz && \

Check warning on line 160 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_Q&open=AZ-nD54j7Nsapz3kwv_Q&pullRequest=744
curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt" -o /tmp/node.sha256 && \

Check warning on line 161 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_R&open=AZ-nD54j7Nsapz3kwv_R&pullRequest=744
awk -v t="${NODE_TARBALL}" '$2 == t { print $1 " /tmp/node.tar.xz" }' /tmp/node.sha256 | sha256sum -c - && \
mkdir -p /opt/node && \
tar -xJf /tmp/node.tar.xz -C /opt/node --strip-components=1 && \
tar --no-same-owner -xJf /tmp/node.tar.xz -C /opt/node --strip-components=1 && \
rm -f /tmp/node.tar.xz /tmp/node.sha256 && \
corepack enable

Expand All @@ -176,18 +178,16 @@
BUNDLE_DEPLOYMENT="1" \
BUNDLE_WITHOUT="development:test"

COPY --chown=1000:0 --chmod=440 Gemfile Gemfile.lock ./
COPY --chown=1000:0 . .

RUN --mount=type=cache,target=/usr/local/bundle/cache,uid=1000 \
bundle install && \

Check warning on line 184 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Dependency versions are not predictable. Use a lock-file enforcing command instead. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_S&open=AZ-nD54j7Nsapz3kwv_S&pullRequest=744
rm -rf "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git && \
bundle exec bootsnap precompile --gemfile

COPY --chown=1000:0 --chmod=440 package.json yarn.lock esbuild.config.js ./
RUN --mount=type=cache,target=/tmp/.yarn-cache,uid=1000 \
yarn install --frozen-lockfile --production=false --network-timeout 100000 --cache-folder /tmp/.yarn-cache

Check warning on line 189 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Lifecycle scripts are enabled by default in Yarn v2+. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_T&open=AZ-nD54j7Nsapz3kwv_T&pullRequest=744

COPY --chown=1000:0 . .

RUN bundle exec bootsnap precompile app/ lib/ && \
SECRET_KEY_BASE_DUMMY=1 ./bin/rails assets:precompile && \
rm -rf \
Expand Down Expand Up @@ -235,11 +235,9 @@
BUNDLE_DEPLOYMENT="0" \
LD_PRELOAD="/usr/local/lib/libjemalloc.so"

COPY --chown=1000:0 --chmod=440 Gemfile Gemfile.lock ./
COPY --chown=1000:0 Gemfile Gemfile.lock package.json yarn.lock esbuild.config.js ./
RUN bundle install

Check warning on line 239 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Dependency versions are not predictable. Use a lock-file enforcing command instead. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_U&open=AZ-nD54j7Nsapz3kwv_U&pullRequest=744

COPY --chown=1000:0 --chmod=440 package.json yarn.lock esbuild.config.js ./
RUN yarn install --frozen-lockfile

Check warning on line 240 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Lifecycle scripts are enabled by default in Yarn v2+. 


See more on https://sonarcloud.io/project/issues?id=mitre_vulcan&issues=AZ-nD54j7Nsapz3kwv_V&open=AZ-nD54j7Nsapz3kwv_V&pullRequest=744

COPY --chown=1000:0 . .

Expand Down
4 changes: 3 additions & 1 deletion Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

source 'https://rubygems.org'

ruby '3.4.9'
ruby '3.4.10'

# Bundle edge Rails instead: gem 'rails', github: 'rails/rails'
gem 'rails', '~> 8.0.0'
Expand Down Expand Up @@ -156,3 +156,5 @@ gem 'blueprinter', '~> 1.2'
gem 'blueprinter-activerecord', '~> 1.3'

gem 'oj', '~> 3.16'

gem 'faraday', '~> 1.10', '>= 1.10.6'
27 changes: 14 additions & 13 deletions Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,14 +158,14 @@ GEM
commonmarker (2.7.0-arm64-darwin)
commonmarker (2.7.0-x86_64-linux)
commonmarker (2.7.0-x86_64-linux-musl)
concurrent-ruby (1.3.6)
concurrent-ruby (1.3.8)
connection_pool (3.0.2)
cookstyle (8.4.0)
rubocop (= 1.79.2)
crack (1.0.0)
bigdecimal
rexml
crass (1.0.6)
crass (1.0.7)
csv (3.3.5)
database_cleaner-active_record (2.2.2)
activerecord (>= 5.a)
Expand Down Expand Up @@ -195,7 +195,7 @@ GEM
factory_bot_rails (6.5.1)
factory_bot (~> 6.5)
railties (>= 6.1.0)
faraday (1.10.5)
faraday (1.10.6)
faraday-em_http (~> 1.0)
faraday-em_synchrony (~> 1.0)
faraday-excon (~> 1.1)
Expand All @@ -213,13 +213,13 @@ GEM
faraday-follow_redirects (0.3.0)
faraday (>= 1, < 3)
faraday-httpclient (1.0.1)
faraday-multipart (1.1.1)
faraday-multipart (1.2.0)
multipart-post (~> 2.0)
faraday-net_http (1.0.2)
faraday-net_http_persistent (1.2.0)
faraday-patron (1.0.0)
faraday-rack (1.0.0)
faraday-retry (1.0.3)
faraday-retry (1.0.4)
faraday_middleware (1.2.1)
faraday (~> 1.0)
ffaker (2.24.0)
Expand Down Expand Up @@ -292,7 +292,7 @@ GEM
activesupport (>= 7.0.0)
jsbundling-rails (1.3.1)
railties (>= 6.0.0)
json (2.13.2)
json (2.21.1)
json-jwt (1.15.3.1)
activesupport (>= 4.2)
aes_key_wrap
Expand All @@ -317,7 +317,7 @@ GEM
rb-fsevent (~> 0.10, >= 0.10.3)
rb-inotify (~> 0.9, >= 0.9.10)
logger (1.7.0)
loofah (2.25.1)
loofah (2.25.2)
crass (~> 1.0.2)
nokogiri (>= 1.12.0)
mail (2.9.0)
Expand Down Expand Up @@ -347,7 +347,7 @@ GEM
mixlib-log (3.0.9)
mixlib-shellout (3.3.9)
chef-utils
msgpack (1.8.0)
msgpack (1.8.3)
multi_xml (0.7.2)
bigdecimal (~> 3.1)
multipart-post (2.4.1)
Expand Down Expand Up @@ -392,7 +392,7 @@ GEM
rack (>= 1.2, < 4)
snaky_hash (~> 2.0, >= 2.0.6)
version_gem (~> 1.1, >= 1.1.12)
oj (3.16.16)
oj (3.17.4)
bigdecimal (>= 3.0)
ostruct (>= 0.2)
omniauth (2.1.3)
Expand Down Expand Up @@ -506,8 +506,8 @@ GEM
activesupport (>= 5.0.0)
minitest
nokogiri (>= 1.6)
rails-html-sanitizer (1.7.0)
loofah (~> 2.25)
rails-html-sanitizer (1.7.1)
loofah (~> 2.25, >= 2.25.2)
nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
railties (8.0.5)
actionpack (= 8.0.5)
Expand Down Expand Up @@ -714,7 +714,7 @@ GEM
hashdiff (>= 0.4.0, < 2.0.0)
webrick (1.9.2)
websocket (1.2.11)
websocket-driver (0.8.0)
websocket-driver (0.8.2)
base64
websocket-extensions (>= 0.1.0)
websocket-extensions (0.1.5)
Expand Down Expand Up @@ -755,6 +755,7 @@ DEPENDENCIES
devise-security!
dotenv-rails
factory_bot_rails (~> 6.5.0)
faraday (~> 1.10, >= 1.10.6)
ffaker (~> 2.10)
foreman
haml-rails (~> 2.0)
Expand Down Expand Up @@ -808,7 +809,7 @@ DEPENDENCIES
with_advisory_lock (~> 5.1)

RUBY VERSION
ruby 3.4.9p82
ruby 3.4.10p104

BUNDLED WITH
2.7.2
39 changes: 38 additions & 1 deletion yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1204,6 +1204,15 @@ axios@1.12.2:
form-data "^4.0.4"
proxy-from-env "^1.1.0"

axios@<=1.14.0:
version "1.14.0"
resolved "https://registry.yarnpkg.com/axios/-/axios-1.14.0.tgz#7c29f4cf2ea91ef05018d5aa5399bf23ed3120eb"
integrity sha512-3Y8yrqLSwjuzpXuZ0oIYZ/XGgLwUIBU3uLvbcpb0pidD9ctpShJd43KSlEEkVQg6DS0G9NKyzOvBfUtDKEyHvQ==
dependencies:
follow-redirects "^1.15.11"
form-data "^4.0.5"
proxy-from-env "^2.1.0"

babel-walk@3.0.0-canary-5:
version "3.0.0-canary-5"
resolved "https://registry.yarnpkg.com/babel-walk/-/babel-walk-3.0.0-canary-5.tgz#f66ecd7298357aee44955f235a6ef54219104b11"
Expand Down Expand Up @@ -2095,6 +2104,11 @@ flatted@^3.2.9:
resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.3.3.tgz#67c8fad95454a7c7abebf74bb78ee74a44023358"
integrity sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==

follow-redirects@^1.15.11:
version "1.16.0"
resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.16.0.tgz#28474a159d3b9d11ef62050a14ed60e4df6d61bc"
integrity sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==

follow-redirects@^1.15.6:
version "1.15.11"
resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.11.tgz#777d73d72a92f8ec4d2e410eb47352a56b8e8340"
Expand Down Expand Up @@ -2124,6 +2138,17 @@ form-data@^4.0.4:
hasown "^2.0.2"
mime-types "^2.1.12"

form-data@^4.0.5:
version "4.0.6"
resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.6.tgz#28e864e1b786dbebb68db1f452f9635278665827"
integrity sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==
dependencies:
asynckit "^0.4.0"
combined-stream "^1.0.8"
es-set-tostringtag "^2.1.0"
hasown "^2.0.4"
mime-types "^2.1.35"

fs.realpath@^1.0.0:
version "1.0.0"
resolved "https://registry.yarnpkg.com/fs.realpath/-/fs.realpath-1.0.0.tgz#1504ad2523158caa40db4a2787cb01411994ea4f"
Expand Down Expand Up @@ -2264,6 +2289,13 @@ hasown@^2.0.2:
dependencies:
function-bind "^1.1.2"

hasown@^2.0.4:
version "2.0.4"
resolved "https://registry.yarnpkg.com/hasown/-/hasown-2.0.4.tgz#8c62d8cb90beb2aad5d0a5b67581ad9854c3f003"
integrity sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==
dependencies:
function-bind "^1.1.2"

hast-util-to-html@^9.0.5:
version "9.0.5"
resolved "https://registry.yarnpkg.com/hast-util-to-html/-/hast-util-to-html-9.0.5.tgz#ccc673a55bb8e85775b08ac28380f72d47167005"
Expand Down Expand Up @@ -2831,7 +2863,7 @@ mime-db@1.52.0:
resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.52.0.tgz#bbabcdc02859f4987301c856e3387ce5ec43bf70"
integrity sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==

mime-types@^2.1.12:
mime-types@^2.1.12, mime-types@^2.1.35:
version "2.1.35"
resolved "https://registry.yarnpkg.com/mime-types/-/mime-types-2.1.35.tgz#381a871b62a734450660ae3deee44813f70d959a"
integrity sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==
Expand Down Expand Up @@ -3245,6 +3277,11 @@ proxy-from-env@^1.1.0:
resolved "https://registry.yarnpkg.com/proxy-from-env/-/proxy-from-env-1.1.0.tgz#e102f16ca355424865755d2c9e8ea4f24d58c3e2"
integrity sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==

proxy-from-env@^2.1.0:
version "2.1.0"
resolved "https://registry.yarnpkg.com/proxy-from-env/-/proxy-from-env-2.1.0.tgz#a7487568adad577cfaaa7e88c49cab3ab3081aba"
integrity sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==

prr@~1.0.1:
version "1.0.1"
resolved "https://registry.yarnpkg.com/prr/-/prr-1.0.1.tgz#d3fc114ba06995a45ec6893f484ceb1d78f5f476"
Expand Down
Loading