From f49bb8dce1bdfc296cd2b75c35b7b5087370511d Mon Sep 17 00:00:00 2001 From: Hardy Nguyen Date: Wed, 5 Aug 2026 07:14:15 +0000 Subject: [PATCH 01/10] chore(deps): bump brace-expansion from 2.1.2 to 2.1.4 --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 92499856..0a4cce9c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -4697,9 +4697,9 @@ "license": "MIT" }, "node_modules/test-exclude/node_modules/brace-expansion": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", - "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { From 8b13297508cbc8e7896b0344db245fe85f995b97 Mon Sep 17 00:00:00 2001 From: Hardy Nguyen Date: Wed, 5 Aug 2026 07:16:36 +0000 Subject: [PATCH 02/10] chore(deps): bump brace-expansion from 5.0.7 to 5.0.9 --- package-lock.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 0a4cce9c..b5560ee5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1415,16 +1415,16 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/bytes": { From 117fde28b3cc9adc79645a96d71e5fa5c59457bb Mon Sep 17 00:00:00 2001 From: Hardy Nguyen Date: Wed, 5 Aug 2026 07:22:22 +0000 Subject: [PATCH 03/10] chore(deps): bump ip-address from 10.2.0 to 10.3.1 --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index b5560ee5..1db8977a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2766,9 +2766,9 @@ "license": "ISC" }, "node_modules/ip-address": { - "version": "10.2.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", - "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "version": "10.3.1", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.3.1.tgz", + "integrity": "sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g==", "dev": true, "license": "MIT", "engines": { From a91b75aedfde46a26ae29ac4743b5f3bb22a2586 Mon Sep 17 00:00:00 2001 From: Hardy Nguyen Date: Wed, 5 Aug 2026 07:23:55 +0000 Subject: [PATCH 04/10] chore(deps): bump undici from 6.27.0 to 6.28.0 --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 1db8977a..09e938b3 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5004,9 +5004,9 @@ } }, "node_modules/undici": { - "version": "6.27.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz", - "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==", + "version": "6.28.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz", + "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==", "dev": true, "license": "MIT", "engines": { From 967c6af50fe499255ca8482d8e89a26e52332573 Mon Sep 17 00:00:00 2001 From: Hardy Nguyen Date: Wed, 5 Aug 2026 07:38:02 +0000 Subject: [PATCH 05/10] chore: e2e - add .npmrc with min-release-age rules to harden supply-chain --- e2e/.npmrc | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 e2e/.npmrc diff --git a/e2e/.npmrc b/e2e/.npmrc new file mode 100644 index 00000000..044f0422 --- /dev/null +++ b/e2e/.npmrc @@ -0,0 +1,16 @@ +# Supply-chain hardening for dependency installs/updates. +# +# min-release-age=7 tells npm to only install package versions that were +# published more than 7 days ago. npm implements this by rewriting it to +# `--before = now - 7 days`, so freshly published versions (a common vector +# for compromised/malicious releases) are excluded until they've had time to +# be detected and pulled from the registry. +# +# Requires npm >= 11.10.0. Older npm (e.g. the npm 10.x bundled with the +# Node 20/22 this repo supports) does not recognize the setting and silently +# ignores it, so it hardens installs on npm 11+ without breaking older clients. +min-release-age=7 + +# exclude min-release-age=7 rule for all packages of @pkg-nec organization +# Requires npm >= 12.0.0 +min-release-age-exclude[]="@pkg-nec/*" From 928071def59f9dd4e3a0ba28c15c6b12644b144f Mon Sep 17 00:00:00 2001 From: Hardy Nguyen Date: Wed, 5 Aug 2026 07:28:07 +0000 Subject: [PATCH 06/10] chore(deps): e2e - bump brace-expansion from 2.1.2 to 2.1.4 --- e2e/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/e2e/package-lock.json b/e2e/package-lock.json index 8b23edb5..1136f14c 100644 --- a/e2e/package-lock.json +++ b/e2e/package-lock.json @@ -3709,9 +3709,9 @@ "license": "MIT" }, "node_modules/test-exclude/node_modules/brace-expansion": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", - "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { From 85434a48d7e234e876df7d4febe6154b73ddfc11 Mon Sep 17 00:00:00 2001 From: Hardy Nguyen Date: Wed, 5 Aug 2026 07:30:01 +0000 Subject: [PATCH 07/10] chore(deps): e2e - bump brace-expansion from 5.0.7 to 5.0.9 --- e2e/package-lock.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/e2e/package-lock.json b/e2e/package-lock.json index 1136f14c..b67fedbf 100644 --- a/e2e/package-lock.json +++ b/e2e/package-lock.json @@ -1348,16 +1348,16 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/c8": { From 789587cf94761e7ec44f30ffcccd13fb9c96f7bc Mon Sep 17 00:00:00 2001 From: Hardy Nguyen Date: Wed, 5 Aug 2026 07:31:56 +0000 Subject: [PATCH 08/10] chore(deps): e2e - bump ip-address from 10.2.0 to 10.3.1 --- e2e/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/e2e/package-lock.json b/e2e/package-lock.json index b67fedbf..196dd225 100644 --- a/e2e/package-lock.json +++ b/e2e/package-lock.json @@ -2166,9 +2166,9 @@ "license": "ISC" }, "node_modules/ip-address": { - "version": "10.2.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", - "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "version": "10.3.1", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.3.1.tgz", + "integrity": "sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g==", "dev": true, "license": "MIT", "engines": { From b98fa7a7a9970d08ed359e5ac2fb6874d1ea2d4a Mon Sep 17 00:00:00 2001 From: Hardy Nguyen Date: Wed, 5 Aug 2026 07:34:39 +0000 Subject: [PATCH 09/10] chore(deps): e2e - bump tar from 7.5.20 to 7.5.22 --- e2e/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/e2e/package-lock.json b/e2e/package-lock.json index 196dd225..577c320e 100644 --- a/e2e/package-lock.json +++ b/e2e/package-lock.json @@ -3625,9 +3625,9 @@ } }, "node_modules/tar": { - "version": "7.5.20", - "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.20.tgz", - "integrity": "sha512-9FcyK4PA6+WbzlTM9WhQm6vB5W7cP7dUiPsv1g7YDwEQnQ1CGpK3MGlKk/ITVWMk05kHZuBhmVhiv8LZoy/PFQ==", + "version": "7.5.22", + "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz", + "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { From 5c5d14578ff66b2cf8799f6ca019ee515ce987c8 Mon Sep 17 00:00:00 2001 From: Hardy Nguyen Date: Wed, 5 Aug 2026 07:36:30 +0000 Subject: [PATCH 10/10] chore(deps): e2e - bump undici from 6.27.0 to 6.28.0 --- e2e/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/e2e/package-lock.json b/e2e/package-lock.json index 577c320e..6f4237b7 100644 --- a/e2e/package-lock.json +++ b/e2e/package-lock.json @@ -3967,9 +3967,9 @@ } }, "node_modules/undici": { - "version": "6.27.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz", - "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==", + "version": "6.28.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz", + "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==", "dev": true, "license": "MIT", "engines": {