Fix 23 Dependabot alerts (#562)

Cargo.lock

@@ -249,7 +249,7 @@ dependencies = [
  "enumflags2",
  "futures-channel",
  "futures-util",
- "rand 0.8.5",
+ "rand 0.8.7",
  "serde",
  "serde_repr",
  "url",
@@ -265,7 +265,7 @@ dependencies = [
  "enumflags2",
  "futures-channel",
  "futures-util",
- "rand 0.9.1",
+ "rand 0.9.5",
  "raw-window-handle",
  "serde",
  "serde_repr",
@@ -585,9 +585,9 @@ checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.16.1"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94bffc006df10ac2a68c83692d734a465f8ee6c5b384d8545a636f81d858f4bf"
+checksum = "ce2b2dcc879c3bae0d371e77c99f2238400ef24ec001394befa67b6e543add9e"
 dependencies = [
  "aws-lc-sys",
  "zeroize",
@@ -595,14 +595,15 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.38.0"
+version = "0.44.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4321e568ed89bb5a7d291a7f37997c2c0df89809d7b6d12062c81ddb54aa782e"
+checksum = "f09fae7be8bb3174e05c6afdb34199e6dc0c7c04ba9fa237b1967adfbde27483"
 dependencies = [
  "cc",
  "cmake",
  "dunce",
  "fs_extra",
+ "pkg-config",
 ]
 
 [[package]]
@@ -4463,7 +4464,7 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ffa00dec017b5b1a8b7cf5e2c008bfda1aa7e0697ac1508b491fdf2622fb4d8"
 dependencies = [
- "rand 0.8.5",
+ "rand 0.8.7",
 ]
 
 [[package]]
@@ -5023,15 +5024,14 @@ dependencies = [
 
 [[package]]
 name = "openssl"
-version = "0.10.73"
+version = "0.10.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8505734d46c8ab1e19a1dce3aef597ad87dcb4c37e7188231769bd6bd51cebf8"
+checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
 dependencies = [
  "bitflags 2.11.0",
  "cfg-if",
  "foreign-types 0.3.2",
  "libc",
- "once_cell",
  "openssl-macros",
  "openssl-sys",
 ]
@@ -5055,18 +5055,18 @@ checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
 
 [[package]]
 name = "openssl-src"
-version = "300.5.0+3.5.0"
+version = "300.6.1+3.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8ce546f549326b0e6052b649198487d91320875da901e7bd11a06d1ee3f9c2f"
+checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846"
 dependencies = [
  "cc",
 ]
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.109"
+version = "0.9.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90096e2e47630d78b7d1c20952dc621f957103f8bc2c8359ec81290d75238571"
+checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
 dependencies = [
  "cc",
  "libc",
@@ -5880,7 +5880,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6"
 dependencies = [
  "phf_shared 0.10.0",
- "rand 0.8.5",
+ "rand 0.8.7",
 ]
 
 [[package]]
@@ -5890,7 +5890,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
 dependencies = [
  "phf_shared 0.11.3",
- "rand 0.8.5",
+ "rand 0.8.7",
 ]
 
 [[package]]
@@ -6455,9 +6455,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",
@@ -6466,9 +6466,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.1"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.3",
@@ -7348,7 +7348,7 @@ dependencies = [
  "borsh",
  "bytes",
  "num-traits",
- "rand 0.8.5",
+ "rand 0.8.7",
  "rkyv",
  "serde",
  "serde_json",
@@ -9509,7 +9509,7 @@ dependencies = [
  "indexmap 1.9.3",
  "pin-project",
  "pin-project-lite",
- "rand 0.8.5",
+ "rand 0.8.7",
  "slab",
  "tokio",
  "tokio-util",
@@ -9726,7 +9726,7 @@ dependencies = [
  "http",
  "httparse",
  "log 0.4.29",
- "rand 0.9.1",
+ "rand 0.9.5",
  "rustls",
  "rustls-pki-types",
  "sha1",
@@ -9996,7 +9996,7 @@ checksum = "3cf4199d1e5d15ddd86a694e4d0dffa9c323ce759fea589f00fef9d81cc1931d"
 dependencies = [
  "getrandom 0.3.3",
  "js-sys",
- "rand 0.9.1",
+ "rand 0.9.5",
  "serde",
  "wasm-bindgen",
 ]
@@ -11240,7 +11240,7 @@ dependencies = [
  "pretty_graphql",
  "r2d2",
  "r2d2_sqlite",
- "rand 0.9.1",
+ "rand 0.9.5",
  "reqwest 0.12.20",
  "rlimit",
  "serde",
@@ -11325,7 +11325,7 @@ dependencies = [
  "log 0.4.29",
  "oxc_resolver",
  "predicates",
- "rand 0.8.5",
+ "rand 0.8.7",
  "reqwest 0.12.20",
  "rolldown",
  "schemars 0.8.22",
@@ -11534,7 +11534,7 @@ dependencies = [
  "csscolorparser",
  "log 0.4.29",
  "objc",
- "rand 0.9.1",
+ "rand 0.9.5",
  "tauri",
  "tauri-plugin",
 ]
@@ -11576,7 +11576,7 @@ dependencies = [
  "log 0.4.29",
  "md5 0.7.0",
  "path-slash",
- "rand 0.9.1",
+ "rand 0.9.5",
  "reqwest 0.12.20",
  "serde",
  "serde_json",
@@ -11754,7 +11754,7 @@ version = "0.1.0"
 dependencies = [
  "log 0.4.29",
  "md5 0.8.0",
- "rand 0.9.1",
+ "rand 0.9.5",
  "serde",
  "serde_json",
  "tauri",

apps/yaak-client/package.json

@@ -93,14 +93,12 @@
     "@yaakapp-internal/theme": "^1.0.0",
     "@yaakapp-internal/ui": "^1.0.0",
     "babel-plugin-react-compiler": "^1.0.0",
-    "decompress": "^4.2.1",
     "internal-ip": "^8.0.0",
     "rollup": "^4.60.3",
-    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.1",
+    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.9",
     "vite-plugin-static-copy": "^3.3.0",
     "vite-plugin-svgr": "^4.5.0",
-    "vite-plugin-top-level-await": "^1.5.0",
     "vite-plugin-wasm": "^3.5.0",
-    "vite-plus": "^0.2.1"
+    "vite-plus": "^0.2.9"
   }
 }

apps/yaak-client/vite.config.ts

@@ -6,7 +6,6 @@ import path from "node:path";
 import { defineConfig, normalizePath } from "vite-plus";
 import { viteStaticCopy } from "vite-plugin-static-copy";
 import svgr from "vite-plugin-svgr";
-import topLevelAwait from "vite-plugin-top-level-await";
 import wasm from "vite-plugin-wasm";
 
 const require = createRequire(import.meta.url);
@@ -43,10 +42,11 @@ export default defineConfig(async () => {
           : {},
     },
     // The browser host runs the model layer in a worker; that bundle needs the
-    // same wasm and top-level-await handling as the main one.
+    // same wasm handling as the main one. Top-level await needs no transform
+    // because the build targets esnext.
     worker: {
       format: "es" as const,
-      plugins: () => [wasm(), topLevelAwait()],
+      plugins: () => [wasm()],
     },
     plugins: [
       wasm(),
@@ -58,7 +58,6 @@ export default defineConfig(async () => {
       }),
       svgr(),
       react(),
-      topLevelAwait(),
       viteStaticCopy({
         targets: [
           { src: cMapsDir, dest: "" },

apps/yaak-proxy/package.json

@@ -31,7 +31,7 @@
     "@vitejs/plugin-react": "^6.0.1",
     "babel-plugin-react-compiler": "^1.0.0",
     "typescript": "^5.8.3",
-    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.1",
+    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.9",
-    "vite-plus": "^0.2.1"
+    "vite-plus": "^0.2.9"
   }
 }

package.json

@@ -126,14 +126,16 @@
     "npm-run-all": "^4.1.5",
     "postcss": "^8.5.25",
     "tailwindcss": "^4.3.2",
+    "tar": "^7.5.22",
     "typescript": "^5.8.3",
-    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.1",
+    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.9",
-    "vite-plus": "^0.2.1",
+    "vite-plus": "^0.2.9",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.10",
+    "yauzl": "^3.4.0"
   },
   "overrides": {
-    "js-yaml": "^4.1.1",
+    "js-yaml": "^4.3.1",
-    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.1"
+    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.9"
   },
   "packageManager": "npm@11.11.1"
 }

plugins/importer-openapi/package.json

@@ -10,7 +10,7 @@
     "test": "vp test --run tests"
   },
   "dependencies": {
-    "openapi-to-postmanv2": "^5.8.0",
+    "openapi-to-postmanv2": "^6.3.3",
     "yaml": "^2.8.3"
   },
   "devDependencies": {

scripts/extract-archive.cjs

@@ -0,0 +1,77 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const tar = require("tar");
+const yauzl = require("yauzl");
+
+// Resolve an archive entry against destDir, refusing anything that escapes it.
+function safeJoin(destDir, entryName) {
+  const root = path.resolve(destDir);
+  const resolved = path.resolve(root, entryName);
+  if (resolved !== root && !resolved.startsWith(root + path.sep)) {
+    throw new Error(`Archive entry escapes destination directory: ${entryName}`);
+  }
+  return resolved;
+}
+
+function extractZip(filePath, destDir) {
+  return new Promise((resolve, reject) => {
+    yauzl.open(filePath, { lazyEntries: true }, (err, zip) => {
+      if (err) return reject(err);
+      zip.on("error", reject);
+      zip.on("end", resolve);
+      zip.on("entry", (entry) => {
+        let dst;
+        try {
+          dst = safeJoin(destDir, entry.fileName);
+        } catch (e) {
+          return reject(e);
+        }
+
+        // Unix mode lives in the high 16 bits of the external attributes
+        const rawMode = (entry.externalFileAttributes >>> 16) & 0xffff;
+        const isSymlink = (rawMode & 0o170000) === 0o120000;
+        if (isSymlink) {
+          return reject(new Error(`Refusing to extract symlink from archive: ${entry.fileName}`));
+        }
+
+        if (entry.fileName.endsWith("/")) {
+          fs.mkdirSync(dst, { recursive: true });
+          return zip.readEntry();
+        }
+
+        zip.openReadStream(entry, (err2, stream) => {
+          if (err2) return reject(err2);
+          fs.mkdirSync(path.dirname(dst), { recursive: true });
+          const out = fs.createWriteStream(dst);
+          stream.on("error", reject);
+          out.on("error", reject);
+          out.on("close", () => {
+            const mode = rawMode & 0o7777;
+            if (mode !== 0) fs.chmodSync(dst, mode);
+            zip.readEntry();
+          });
+          stream.pipe(out);
+        });
+      });
+      zip.readEntry();
+    });
+  });
+}
+
+/**
+ * Extract a `.zip` or `.tar.gz` archive into destDir, preserving file modes.
+ * Entries that would land outside destDir are rejected.
+ */
+async function extractArchive(filePath, destDir) {
+  fs.mkdirSync(destDir, { recursive: true });
+  if (filePath.endsWith(".zip")) {
+    await extractZip(filePath, destDir);
+  } else if (filePath.endsWith(".tar.gz") || filePath.endsWith(".tgz")) {
+    // oxlint-disable-next-line await-thenable -- tar.x() returns a promise when `file` is set
+    await tar.x({ file: filePath, cwd: destDir });
+  } else {
+    throw new Error(`Unsupported archive format: ${path.basename(filePath)}`);
+  }
+}
+
+module.exports = { extractArchive };

scripts/vendor-node.cjs

@@ -1,8 +1,8 @@
 const path = require("node:path");
 const crypto = require("node:crypto");
 const fs = require("node:fs");
-const decompress = require("decompress");
 const Downloader = require("nodejs-file-downloader");
+const { extractArchive } = require("./extract-archive.cjs");
 const { rmSync, cpSync, mkdirSync, existsSync } = require("node:fs");
 const { execSync } = require("node:child_process");
 
@@ -92,7 +92,7 @@ rmSync(tmpDir, { recursive: true, force: true });
   console.log("SHA256 verified:", actualHash);
 
   // Decompress to the same directory
-  await decompress(filePath, tmpDir, {});
+  await extractArchive(filePath, tmpDir);
 
   // Copy binary
   const binSrc = path.join(tmpDir, SRC_BIN_MAP[key]);

scripts/vendor-protoc.cjs

@@ -1,7 +1,7 @@
 const crypto = require("node:crypto");
 const fs = require("node:fs");
-const decompress = require("decompress");
 const Downloader = require("nodejs-file-downloader");
+const { extractArchive } = require("./extract-archive.cjs");
 const path = require("node:path");
 const { rmSync, mkdirSync, cpSync, existsSync, statSync, chmodSync } = require("node:fs");
 const { execSync } = require("node:child_process");
@@ -86,7 +86,7 @@ mkdirSync(dstDir, { recursive: true });
   console.log("SHA256 verified:", actualHash);
 
   // Decompress to the same directory
-  await decompress(filePath, tmpDir, {});
+  await extractArchive(filePath, tmpDir);
 
   // Copy binary
   cpSync(binSrc, binDst);