From a6564e9f63d521c82ab16a22f4aa2534b0982f27 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 12:39:13 +0000 Subject: [PATCH 1/2] chore(login): bumped base to v4.18.0 + reapplied branding --- .github/workflows/cs-iam-login.yml | 82 +++++++ .github/workflows/lint_test_build.yml | 14 +- .github/workflows/pack.yml | 139 ++--------- .github/workflows/release.yml | 26 +-- .github/workflows/upstream-bump.yml | 217 ++++++++++++++++++ apps/login/package.json | 3 +- .../components/idps/sign-in-with-generic.tsx | 98 +++++++- cs-iam-login.Dockerfile | 63 +++++ cs-iam-login.Dockerfile.dockerignore | 11 + cs-iam-login.base-version | 1 + pnpm-lock.yaml | 11 + 11 files changed, 506 insertions(+), 159 deletions(-) create mode 100644 .github/workflows/cs-iam-login.yml create mode 100644 .github/workflows/upstream-bump.yml create mode 100644 cs-iam-login.Dockerfile create mode 100644 cs-iam-login.Dockerfile.dockerignore create mode 100644 cs-iam-login.base-version diff --git a/.github/workflows/cs-iam-login.yml b/.github/workflows/cs-iam-login.yml new file mode 100644 index 00000000000..3fd221a5a2e --- /dev/null +++ b/.github/workflows/cs-iam-login.yml @@ -0,0 +1,82 @@ +name: 🐳 CS-IAM Login Image + +# BAUER GROUP fork build: publishes the branded Zitadel Login v2 image to GHCR. +# Upstream zitadel workflows stay disabled (Actions UI); this is our pipeline. +# Self-contained build (docker/build-push-action) — robust in a public fork. +# Production = release line (push); feature/*** PRs are validated build-only. + +on: + push: + branches: [production] + paths: + - "apps/login/**" + - "packages/**" + - "proto/**" + - "cs-iam-login.Dockerfile" + - "cs-iam-login.Dockerfile.dockerignore" + - "cs-iam-login.base-version" + - "pnpm-lock.yaml" + - ".github/workflows/cs-iam-login.yml" + pull_request: + branches: [production] + workflow_dispatch: + +permissions: + contents: read + packages: write + +concurrency: + group: cs-iam-login-${{ github.ref }} + cancel-in-progress: true + +jobs: + build: + name: 🐳 Build & Push login + runs-on: ubuntu-latest + timeout-minutes: 30 + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Resolve image version + id: ver + run: | + set -euo pipefail + V="$(tr -d '[:space:]' < cs-iam-login.base-version)" + V="${V#v}" # tag the image with the numeric upstream version (no leading v) + echo "version=$V" >> "$GITHUB_OUTPUT" + echo "::notice::Building login image version $V" + + - name: Set up Buildx + uses: docker/setup-buildx-action@v3 + + - name: Log in to GHCR + if: github.event_name != 'pull_request' + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Image metadata + id: meta + uses: docker/metadata-action@v5 + with: + images: ghcr.io/bauer-group/ep-zitadel/zitadel-login + tags: | + type=raw,value=${{ steps.ver.outputs.version }} + type=raw,value=stable + type=raw,value=latest,enable={{is_default_branch}} + type=sha + + - name: Build & push + uses: docker/build-push-action@v6 + with: + context: . + file: ./cs-iam-login.Dockerfile + platforms: linux/amd64 + push: ${{ github.event_name != 'pull_request' }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max diff --git a/.github/workflows/lint_test_build.yml b/.github/workflows/lint_test_build.yml index f78ac575452..fb85a2250bc 100644 --- a/.github/workflows/lint_test_build.yml +++ b/.github/workflows/lint_test_build.yml @@ -55,23 +55,13 @@ jobs: run: pnpm install --frozen-lockfile - name: Set SHAs for nx affected commands uses: nrwl/nx-set-shas@v4 - # The Depot runner image points /etc/resolv.conf directly at public DNS (8.8.8.8), - # bypassing the systemd-resolved stub, so *.integration.localhost (synthesized by - # systemd-resolved) no longer resolves and all API integration tests hang. - # Route DNS back through the stub until the image is fixed or the tests stop - # depending on wildcard localhost DNS. - - name: Restore systemd-resolved stub for *.localhost resolution - run: | - set -ex - test -e /run/systemd/resolve/stub-resolv.conf - sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf - getent hosts foo.integration.localhost - name: Lint, Test and Build env: NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }} + # NX_NATIVE_LOGGING: "nx::native::cache,nx::native::db" NX_DAEMON: "false" NX_DISABLE_DB: "true" - run: pnpm nx affected --nxBail --targets test build --exclude @zitadel/docs + run: pnpm nx affected --nxBail --targets lint test build --exclude @zitadel/docs - name: Check for uncommitted changes (Codegen mismatch) run: git diff --exit-code - name: Suggest Pipeline Fix By Nx Cloud AI diff --git a/.github/workflows/pack.yml b/.github/workflows/pack.yml index 649d4dc3216..8a92edbd6c1 100644 --- a/.github/workflows/pack.yml +++ b/.github/workflows/pack.yml @@ -40,7 +40,7 @@ jobs: semantic_version: ${{ inputs.semantic_version }} dry_run: true - pack-archives: + pack: runs-on: group: zitadel-public environment: ${{ github.ref_protected == 'true' && 'Protected' || null }} @@ -67,6 +67,10 @@ jobs: with: node-version: ${{ inputs.node_version }} cache: "pnpm" + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + with: + version: v0.28.0 - name: Install dependencies run: pnpm install --frozen-lockfile - name: Pack API and Login @@ -84,59 +88,11 @@ jobs: with: name: zitadel-archives path: .artifacts/pack - - docker: - runs-on: - group: zitadel-public - environment: ${{ github.ref_protected == 'true' && 'Protected' || null }} - needs: [version, pack-archives] - permissions: - contents: read - packages: write - strategy: - matrix: - include: - - gofips140: "off" - tag_suffix: "" - push_ghcr: true - - gofips140: "certified" - tag_suffix: "-fips" - push_ghcr: false - steps: - - name: Checkout Repository - uses: actions/checkout@v4 - with: - fetch-depth: 0 - filter: tree:0 - - name: Set up Go - uses: actions/setup-go@v6 - with: - go-version-file: go.mod - - name: Set up pnpm - uses: pnpm/action-setup@v4 - with: - run_install: false - - name: Set up Node.js - uses: actions/setup-node@v4 - with: - node-version: ${{ inputs.node_version }} - cache: "pnpm" - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Build Linux API binaries - env: - ZITADEL_GOFIPS140: ${{ matrix.gofips140 }} - ZITADEL_VERSION: ${{ needs.version.outputs.version }} - NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }} - run: pnpm nx run-many --nxBail -p @zitadel/api -t pack-linux-amd64,pack-linux-arm64 - name: Set up QEMU uses: docker/setup-qemu-action@v3 - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 - with: - version: v0.28.0 - name: Login to Docker registry - if: matrix.push_ghcr uses: docker/login-action@v3 with: registry: ghcr.io @@ -148,36 +104,24 @@ jobs: registry: europe-docker.pkg.dev username: _json_key_base64 password: ${{ secrets.GCR_JSON_KEY_BASE64 }} - - name: Set API image names - id: api-images - run: | - if [ "${{ matrix.push_ghcr }}" = "true" ]; then - { - echo "${{ inputs.image_name_github_api }}" - echo "${{ inputs.image_name_google_api }}" - } > api-images.txt - else - echo "${{ inputs.image_name_google_api }}" > api-images.txt - fi - echo "list<> "$GITHUB_OUTPUT" - cat api-images.txt >> "$GITHUB_OUTPUT" - echo "EOF" >> "$GITHUB_OUTPUT" - name: Generate Standard Tags and Labels from the GitHub Context for the API Scratch Container Image id: scratch-meta uses: docker/metadata-action@v5 with: - images: ${{ steps.api-images.outputs.list }} + images: | + ${{ inputs.image_name_github_api }} + ${{ inputs.image_name_google_api }} labels: ${{ env.default_labels}} tags: | - type=sha,prefix=,suffix=${{ matrix.tag_suffix }},format=long + type=sha,prefix=,suffix=,format=long - name: Build and Push the SHA-tagged API Scratch Container Image id: build-scratch uses: docker/build-push-action@v6 timeout-minutes: 3 with: context: . - cache-from: type=gha,scope=api-scratch-${{ matrix.gofips140 }} - cache-to: type=gha,mode=max,scope=api-scratch-${{ matrix.gofips140 }} + cache-from: type=gha + cache-to: type=gha,mode=max file: apps/api/Dockerfile target: final platforms: linux/amd64,linux/arm64 @@ -188,19 +132,20 @@ jobs: id: debug-meta uses: docker/metadata-action@v5 with: - images: ${{ steps.api-images.outputs.list }} + images: | + ${{ inputs.image_name_github_api }} + ${{ inputs.image_name_google_api }} labels: ${{ env.default_labels}} tags: | - type=sha,prefix=,suffix=${{ matrix.tag_suffix }}-debug,format=long + type=sha,prefix=,suffix=-debug,format=long - name: Build and Push the SHA-tagged API Debug Container Image - if: matrix.push_ghcr id: build-debug uses: docker/build-push-action@v6 timeout-minutes: 5 with: context: . - cache-from: type=gha,scope=api-debug-${{ matrix.gofips140 }} - cache-to: type=gha,mode=max,scope=api-debug-${{ matrix.gofips140 }} + cache-from: type=gha + cache-to: type=gha,mode=max file: apps/api/Dockerfile target: builder platforms: linux/amd64,linux/arm64 @@ -208,25 +153,7 @@ jobs: labels: ${{ steps.debug-meta.outputs.labels }} tags: ${{ steps.debug-meta.outputs.tags }} outputs: type=image,name=${{ inputs.image_name_github_api }},name-canonical=true - - name: Build and Push the SHA-tagged API Debug Container Image (GAR only) - if: ${{ !matrix.push_ghcr }} - uses: docker/build-push-action@v6 - timeout-minutes: 5 - with: - context: . - cache-from: type=gha,scope=api-debug-${{ matrix.gofips140 }} - cache-to: type=gha,mode=max,scope=api-debug-${{ matrix.gofips140 }} - file: apps/api/Dockerfile - target: builder - platforms: linux/amd64,linux/arm64 - push: true - labels: ${{ steps.debug-meta.outputs.labels }} - tags: ${{ steps.debug-meta.outputs.tags }} - - name: Build Login standalone - if: matrix.push_ghcr - run: pnpm nx run --nxBail @zitadel/login:build - name: Generate Standard Tags and Labels from the GitHub Context for the Login Container Image - if: matrix.push_ghcr id: login-meta uses: docker/metadata-action@v5 with: @@ -239,42 +166,14 @@ jobs: tags: | type=sha,prefix=,suffix=,format=long - name: Build and Push the SHA-tagged Login Container Image - if: matrix.push_ghcr id: build-login uses: docker/build-push-action@v6 timeout-minutes: 3 with: context: apps/login - cache-from: type=gha,scope=login - cache-to: type=gha,mode=max,scope=login + cache-from: type=gha + cache-to: type=gha,mode=max platforms: linux/amd64,linux/arm64 push: true labels: ${{ steps.login-meta.outputs.labels }} tags: ${{ steps.login-meta.outputs.tags }} - - name: Build Login standalone - if: ${{ !matrix.push_ghcr }} - run: pnpm nx run --nxBail @zitadel/login:build - - name: Generate tags for FIPS Login image - if: ${{ !matrix.push_ghcr }} - id: login-fips-meta - uses: docker/metadata-action@v5 - with: - images: ${{ inputs.image_name_google_login }} - labels: | - org.opencontainers.image.licenses=MIT - ${{ env.default_labels}} - tags: | - type=sha,prefix=,suffix=-fips,format=long - - name: Build and Push FIPS Login image (GAR only) - if: ${{ !matrix.push_ghcr }} - uses: docker/build-push-action@v6 - timeout-minutes: 3 - with: - context: apps/login - file: apps/login/Dockerfile.fips - cache-from: type=gha,scope=login-fips - cache-to: type=gha,mode=max,scope=login-fips - platforms: linux/amd64,linux/arm64 - push: true - labels: ${{ steps.login-fips-meta.outputs.labels }} - tags: ${{ steps.login-fips-meta.outputs.tags }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7fbead1f652..b68fb62a0ab 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -103,24 +103,15 @@ jobs: docker buildx imagetools create \ --tag ${{ inputs.image_name_google_api }}:${{ needs.version.outputs.version }} \ ${{ inputs.image_name_google_api }}:${{ github.sha }} - docker buildx imagetools create \ - --tag ${{ inputs.image_name_google_api }}:${{ needs.version.outputs.version }}-fips \ - ${{ inputs.image_name_google_api }}:${{ github.sha }}-fips - docker buildx imagetools create \ - --tag ${{ inputs.image_name_google_api }}:${{ needs.version.outputs.version }}-fips-debug \ - ${{ inputs.image_name_google_api }}:${{ github.sha }}-fips-debug docker buildx imagetools create \ --tag ${{ inputs.image_name_github_login }}:${{ needs.version.outputs.version }} \ ${{ inputs.image_name_github_login }}:${{ github.sha }} docker buildx imagetools create \ --tag ${{ inputs.image_name_google_login }}:${{ needs.version.outputs.version }} \ ${{ inputs.image_name_google_login }}:${{ github.sha }} - docker buildx imagetools create \ - --tag ${{ inputs.image_name_google_login }}:${{ needs.version.outputs.version }}-fips \ - ${{ inputs.image_name_google_login }}:${{ github.sha }}-fips - name: Publish latest - if: ${{ github.ref_name == 'v4.x' }} + if: ${{ github.ref_name == 'next' }} run: | docker buildx imagetools create \ --tag ${{ inputs.image_name_github_api }}:latest \ @@ -131,20 +122,11 @@ jobs: docker buildx imagetools create \ --tag ${{ inputs.image_name_github_login }}:latest \ ${{ inputs.image_name_github_login }}:${{ github.sha }} - docker buildx imagetools create \ - --tag ${{ inputs.image_name_google_api }}:latest-fips \ - ${{ inputs.image_name_google_api }}:${{ github.sha }}-fips - docker buildx imagetools create \ - --tag ${{ inputs.image_name_google_api }}:latest-fips-debug \ - ${{ inputs.image_name_google_api }}:${{ github.sha }}-fips-debug - docker buildx imagetools create \ - --tag ${{ inputs.image_name_google_login }}:latest-fips \ - ${{ inputs.image_name_google_login }}:${{ github.sha }}-fips homebrew-tap: runs-on: ubuntu-22.04 needs: version - if: needs.version.outputs.published == 'true' && github.ref_name == 'v4.x' + if: needs.version.outputs.published == 'true' && github.ref_name == 'next' continue-on-error: true steps: - name: generate token @@ -164,7 +146,7 @@ jobs: helm-chart: runs-on: ubuntu-22.04 needs: version - if: needs.version.outputs.published == 'true' && github.ref_name == 'v4.x' + if: needs.version.outputs.published == 'true' && github.ref_name == 'next' continue-on-error: true steps: - name: generate token @@ -184,7 +166,7 @@ jobs: npm-packages: runs-on: ubuntu-latest needs: version - if: needs.version.outputs.published == 'true' && github.ref_name == 'v4.x' + if: needs.version.outputs.published == 'true' && github.ref_name == 'next' continue-on-error: true steps: - name: Checkout code diff --git a/.github/workflows/upstream-bump.yml b/.github/workflows/upstream-bump.yml new file mode 100644 index 00000000000..43e7e352d61 --- /dev/null +++ b/.github/workflows/upstream-bump.yml @@ -0,0 +1,217 @@ +name: ⬆️ Upstream Login Bump + +# Automatic maintenance: keeps the branded Login v2 image current with upstream. +# +# On a new stable zitadel release (daily check, or manual dispatch) it: +# 1. branches feature/bump- from that tag and re-applies the BAUER GROUP +# branding (the one-file patch + simple-icons + lockfile), +# 2. BUILDS + PUBLISHES the login image (this is the gate — a release that +# breaks our patch fails here and nothing else happens), +# 3. only then FORCE-ROLLS `production` to the new base (production is a +# "release tag + our patch" line, not an accumulating branch). +# +# The published image is PINNED by consumers (CS-IAM LOGIN_BASE_VERSION), so a +# new base never auto-changes a running stack — CS-IAM adopts deliberately, in +# lockstep with the core (BASE_ZITADEL_VERSION). This job just makes sure the +# current image always exists. + +on: + schedule: + - cron: "0 6 * * *" # daily 06:00 UTC — skips fast when already current + workflow_dispatch: + inputs: + target_tag: + description: "Upstream zitadel tag to bump to (blank = latest stable release)" + required: false + type: string + +permissions: + contents: write # force-roll production + packages: write # publish the login image + +concurrency: + group: upstream-bump + cancel-in-progress: false + +jobs: + bump: + name: Track, build & adopt + runs-on: ubuntu-latest + timeout-minutes: 40 + env: + INPUT_TAG: ${{ inputs.target_tag }} + steps: + - name: Checkout production + uses: actions/checkout@v4 + with: + ref: production + fetch-depth: 0 + + - name: Resolve current + target versions + id: ver + env: + GH_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + CURRENT="$(tr -d '[:space:]' < cs-iam-login.base-version 2>/dev/null || true)" + MAJOR="${CURRENT#v}"; MAJOR="${MAJOR%%.*}" + TARGET="$INPUT_TAG" + MANUAL=true + if [ -z "$TARGET" ]; then + # Track the highest STABLE release on the major line we're on (v${MAJOR}.x). + # + # NOT `releases/latest`: zitadel ships parallel maintenance lines, so a + # v3.x backport published *after* the newest v4.x flips GitHub's "latest" + # to v3 (it picks most-recent-by-DATE, not highest semver). That would + # downgrade us across a major and break — apps/login doesn't exist before + # v4. Major jumps are deliberate: dispatch manually with target_tag. + MANUAL=false + TARGET="$(gh api 'repos/zitadel/zitadel/releases?per_page=100' \ + | jq -r --arg m "$MAJOR" ' + [ .[] + | select(.draft == false and .prerelease == false) + | .tag_name + | select((ltrimstr("v") | split(".")) + | (length == 3 and .[0] == $m and all(test("^[0-9]+$")))) + ] + | sort_by(ltrimstr("v") | split(".") | map(tonumber)) + | last // ""')" + fi + if [ -z "$TARGET" ]; then + echo "::error::No stable upstream release resolved (current=$CURRENT, major=$MAJOR)." + exit 1 + fi + DOCKER_VER="${TARGET#v}" # numeric tag for the image (no leading v) + SKIP=false + if [ "$CURRENT" = "$TARGET" ]; then + SKIP=true + echo "::notice::Login already based on $CURRENT — nothing to bump." + elif [ "$MANUAL" = "false" ]; then + # Forward-only on the automatic path: never roll backwards even if the + # resolved tag is somehow older (belt-and-suspenders to the major pin). + HIGHER="$(printf '%s\n%s\n' "${CURRENT#v}" "${TARGET#v}" | sort -V | tail -n1)" + if [ "$HIGHER" = "${CURRENT#v}" ]; then + SKIP=true + echo "::notice::Latest v${MAJOR}.x ($TARGET) is not newer than current ($CURRENT) — nothing to bump." + fi + fi + if [ "$SKIP" = "false" ]; then + echo "::notice::Bumping login base $CURRENT -> $TARGET" + fi + echo "current=$CURRENT" >> "$GITHUB_OUTPUT" + echo "target=$TARGET" >> "$GITHUB_OUTPUT" + echo "docker_ver=$DOCKER_VER" >> "$GITHUB_OUTPUT" + echo "skip=$SKIP" >> "$GITHUB_OUTPUT" + + - name: Set up pnpm + if: steps.ver.outputs.skip == 'false' + uses: pnpm/action-setup@v4 + + - name: Set up Node + if: steps.ver.outputs.skip == 'false' + uses: actions/setup-node@v4 + with: + node-version: 24 + + - name: Prepare the new base + re-apply branding + if: steps.ver.outputs.skip == 'false' + env: + TARGET: ${{ steps.ver.outputs.target }} + run: | + set -euo pipefail + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git remote add upstream https://github.com/zitadel/zitadel.git + git fetch --depth 1 upstream "refs/tags/${TARGET}:refs/tags/${TARGET}" + git checkout -b "feature/bump-${TARGET}" "${TARGET}" + # Bring our (additive + one-file) customization from production. + git checkout production -- \ + cs-iam-login.Dockerfile \ + cs-iam-login.Dockerfile.dockerignore \ + apps/login/src/components/idps/sign-in-with-generic.tsx + # Adopt our COMPLETE CI-infra: replace upstream's workflow tree with + # production's verbatim. Two reasons, both load-bearing: + # 1. The final adopt step pushes with GITHUB_TOKEN, which is FORBIDDEN + # from creating/updating any file under .github/workflows/ (a hard + # GitHub guardrail, not grantable via `permissions:`). Restoring the + # whole tree makes the workflow files byte-identical to production, + # so the force-push introduces zero workflow changes and is allowed. + # 2. Our workflows ARE the CI-infra (production = upstream + CI-infra). + # Cherry-picking only a couple would let upstream's versions of the + # shared workflows leak in and silently overwrite our customizations. + # rm-then-checkout (not a plain checkout) so any upstream-only workflow + # file is dropped too — the tree ends up exactly equal to production's. + git rm -rq .github/workflows + git checkout production -- .github/workflows + # Re-add the simple-icons dependency + record the new base version. + node -e "const f='apps/login/package.json';const p=require('./'+f);p.dependencies=p.dependencies||{};p.dependencies['simple-icons']='^16.23.0';require('fs').writeFileSync(f,JSON.stringify(p,null,2)+'\n');" + echo "${TARGET}" > cs-iam-login.base-version + corepack enable + pnpm install --lockfile-only --no-frozen-lockfile + git add -A + git commit -m "chore(login): bumped base to ${TARGET} + reapplied branding" + + - name: Set up Buildx + if: steps.ver.outputs.skip == 'false' + uses: docker/setup-buildx-action@v3 + + - name: Log in to GHCR + if: steps.ver.outputs.skip == 'false' + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Image metadata + if: steps.ver.outputs.skip == 'false' + id: meta + uses: docker/metadata-action@v5 + with: + images: ghcr.io/bauer-group/ep-zitadel/zitadel-login + tags: | + type=raw,value=${{ steps.ver.outputs.docker_ver }} + type=raw,value=stable + type=raw,value=latest + type=sha + + - name: Build & publish (the gate) + if: steps.ver.outputs.skip == 'false' + uses: docker/build-push-action@v6 + with: + context: . + file: ./cs-iam-login.Dockerfile + platforms: linux/amd64 + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max + + - name: Adopt — force-roll production to the new base + if: steps.ver.outputs.skip == 'false' + run: | + set -euo pipefail + # Reached only when the build above succeeded. + git push origin "HEAD:production" --force + git push origin --delete "feature/bump-${{ steps.ver.outputs.target }}" 2>/dev/null || true + + - name: Summary + if: steps.ver.outputs.skip == 'false' + env: + CURRENT: ${{ steps.ver.outputs.current }} + TARGET: ${{ steps.ver.outputs.target }} + DOCKER_VER: ${{ steps.ver.outputs.docker_ver }} + run: | + { + echo "## ⬆️ Login base bumped" + echo "" + echo "- Base: \`${CURRENT}\` → \`${TARGET}\`" + echo "- Published: \`ghcr.io/bauer-group/ep-zitadel/zitadel-login:${DOCKER_VER}\` (+ stable, latest)" + echo "- \`production\` rolled to the new base." + echo "" + echo "### Next (deliberate, in CS-IAM)" + echo "Bump in lockstep to keep core + login matched:" + echo "- \`LOGIN_BASE_VERSION\` → \`${DOCKER_VER}\` (src/login overlay base)" + echo "- \`BASE_ZITADEL_VERSION\` → \`${TARGET}\` (src/zitadel core)" + } >> "$GITHUB_STEP_SUMMARY" diff --git a/apps/login/package.json b/apps/login/package.json index d186252a889..f6fab6199c8 100644 --- a/apps/login/package.json +++ b/apps/login/package.json @@ -56,7 +56,8 @@ "server-only": "^0.0.1", "tinycolor2": "^1.6.0", "uuid": "^14.0.0", - "winston": "^3.19.0" + "winston": "^3.19.0", + "simple-icons": "^16.23.0" }, "devDependencies": { "@eslint/js": "^10.0.1", diff --git a/apps/login/src/components/idps/sign-in-with-generic.tsx b/apps/login/src/components/idps/sign-in-with-generic.tsx index 9c01547cbc4..28d9f78f561 100644 --- a/apps/login/src/components/idps/sign-in-with-generic.tsx +++ b/apps/login/src/components/idps/sign-in-with-generic.tsx @@ -1,14 +1,104 @@ "use client"; -import { forwardRef } from "react"; +import { forwardRef, type CSSProperties } from "react"; +import { + siFacebook, + siKakaotalk, + siLine, + siNaver, + siQq, + siSinaweibo, + siTiktok, + siVk, + siWechat, + siX, + siZalo, + type SimpleIcon, +} from "simple-icons"; import { BaseButton, SignInWithIdentityProviderProps } from "./base-button"; +// Generic OAuth2/OIDC identity providers have no dedicated branded button, so +// upstream renders them as a plain name while native providers (Google, GitHub, +// Apple, …) show their logo. Match the configured display name to a well-known +// brand glyph (simple-icons) and render the real logo — making social/regional +// providers (Facebook, LINE, WeChat, KakaoTalk, Naver, X, TikTok, QQ, Weibo, +// VK, Zalo) instantly recognisable. Names that don't match keep the original +// name-only button, so there is no behavioural change for unknown providers. +// +// Matches use word boundaries so a token can't hit a substring of an unrelated +// name (e.g. "meta" must not match "Metadata SSO"). +const BRAND_ICONS: { match: RegExp; icon: SimpleIcon }[] = [ + { match: /\bfacebook\b|\bmeta\b/i, icon: siFacebook }, + { match: /\bwechat\b|\bweixin\b|微信/i, icon: siWechat }, + { match: /\bkakao(talk)?\b/i, icon: siKakaotalk }, + { match: /\bnaver\b/i, icon: siNaver }, + { match: /\btiktok\b|\bdouyin\b/i, icon: siTiktok }, + { match: /\bweibo\b|微博/i, icon: siSinaweibo }, + { match: /\bzalo\b/i, icon: siZalo }, + { match: /\bline\b/i, icon: siLine }, + { match: /\bqq\b|\btencent\b/i, icon: siQq }, + { match: /\bvk\b|\bvkontakte\b/i, icon: siVk }, + { match: /\b(x|twitter)\b/i, icon: siX }, +]; + +function brandIcon(name?: string): SimpleIcon | undefined { + if (!name) return undefined; + return BRAND_ICONS.find((b) => b.match.test(name))?.icon; +} + +// simple-icons ship a single brand colour, which can be illegible against one +// theme: near-black brands (X, TikTok #000) vanish on the dark background, and +// near-white ones (KakaoTalk #FFCD00) vanish on the light one. Keep the brand +// colour where it has contrast and only swap the illegible end per theme. The +// fills are exposed as CSS variables + Tailwind `dark:` so the theme switch is +// pure CSS (no JS theme read → no hydration flash). +function brandFills(hex: string): { light: string; dark: string } { + const r = parseInt(hex.slice(0, 2), 16); + const g = parseInt(hex.slice(2, 4), 16); + const b = parseInt(hex.slice(4, 6), 16); + const luminance = (0.2126 * r + 0.7152 * g + 0.0722 * b) / 255; + const brand = `#${hex}`; + return { + light: luminance > 0.7 ? "#18181b" : brand, // too light for the white login bg + dark: luminance < 0.2 ? "#ffffff" : brand, // too dark for the dark login bg + }; +} + export const SignInWithGeneric = forwardRef( function SignInWithGeneric(props, ref) { - const { children, name = "", className = "h-[50px]", ...restProps } = props; + const { children, name = "", className, ...restProps } = props; + const icon = brandIcon(name); + + // Recognised brand: mirror the native branded buttons (Google/GitHub). The + // icon row sets the button height (so no name-only "h-[50px] pl-20" default + // is wanted here), and the visible name is the accessible label — the glyph + // is therefore decorative (aria-hidden, no role/title) to avoid the screen + // reader announcing the provider name twice. + if (icon) { + const fills = brandFills(icon.hex); + return ( + +
+ +
+ {children ? children : {name}} + + ); + } + + // Unknown provider: unchanged upstream name-only button. return ( - - {children ? children : {name}} + + {children ? children : {name}} ); }, diff --git a/cs-iam-login.Dockerfile b/cs-iam-login.Dockerfile new file mode 100644 index 00000000000..6ed055f9cb5 --- /dev/null +++ b/cs-iam-login.Dockerfile @@ -0,0 +1,63 @@ +# =============================================================================== +# BAUER GROUP — Zitadel Login v2 (branded, per-IdP brand logos) +# =============================================================================== +# Self-contained multi-stage build of apps/login from this monorepo. The +# workspace packages (@zitadel/client, @zitadel/proto) + buf proto codegen are +# all present here, so it builds exactly as upstream does — no published-package +# shortcut. Only customization: src/components/idps/sign-in-with-generic.tsx +# (real brand logos via simple-icons). +# +# docker build -f cs-iam-login.Dockerfile -t cs-iam/login . +# =============================================================================== + +# --------------------------------------------------------------------------- +# Stage 1: Builder — produce the standalone Next build +# --------------------------------------------------------------------------- +FROM node:24-alpine AS builder +ENV PNPM_HOME=/pnpm +ENV PATH=$PNPM_HOME:$PATH +RUN corepack enable && apk add --no-cache git ca-certificates +WORKDIR /repo + +COPY . . +RUN pnpm install --no-frozen-lockfile +# Generate the protobuf TS (buf) that @zitadel/client + apps/login depend on. +RUN pnpm --filter @zitadel/proto generate +# Build the login (nx orchestrates @zitadel/client → @zitadel/login standalone). +RUN pnpm nx run @zitadel/login:build + +# --------------------------------------------------------------------------- +# Stage 2: Runtime — mirrors upstream apps/login/Dockerfile +# --------------------------------------------------------------------------- +FROM node:24-alpine + +LABEL vendor="BAUER GROUP" +LABEL maintainer="Karl Bauer " + +LABEL org.opencontainers.image.title="EP-Zitadel Login v2" +LABEL org.opencontainers.image.description="Zitadel Login v2 with per-IdP brand logos - BAUER GROUP fork (EP-Zitadel)" +LABEL org.opencontainers.image.vendor="BAUER GROUP" +LABEL org.opencontainers.image.licenses="MIT" +LABEL org.opencontainers.image.source="https://github.com/bauer-group/EP-Zitadel" + +WORKDIR /app +RUN addgroup --system --gid 1001 nodejs \ + && adduser --system --uid 1001 nextjs +RUN mkdir -p /.env-file && touch /.env-file/.env && chown -R nextjs:nodejs /.env-file + +COPY --from=builder --chown=nextjs:nodejs /repo/apps/login/.next/standalone ./ + +USER nextjs +ENV HOSTNAME="::" \ + PORT="3000" \ + NODE_ENV="production" \ + NODE_OPTIONS="--use-openssl-ca --require /app/load-ssl-cert-dir.cjs" \ + SSL_CERT_FILE="/etc/ssl/certs/ca-certificates.crt" \ + ZITADEL_TLS_ENABLED="false" \ + OTEL_SERVICE_NAME="zitadel-login" \ + OTEL_EXPORTER_OTLP_PROTOCOL="http/protobuf" + +HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \ + CMD ["/usr/local/bin/node", "/app/healthcheck.mjs", "/ui/v2/login/ready"] + +ENTRYPOINT ["/app/entrypoint.sh", "node", "apps/login/server.js"] diff --git a/cs-iam-login.Dockerfile.dockerignore b/cs-iam-login.Dockerfile.dockerignore new file mode 100644 index 00000000000..27cd1c57130 --- /dev/null +++ b/cs-iam-login.Dockerfile.dockerignore @@ -0,0 +1,11 @@ +# Scoped ignore for the CS-IAM login build (buildkit uses this for +# cs-iam-login.Dockerfile and leaves upstream .dockerignore untouched). +# Cut the heavy artifacts; keep ALL source so nx can build the workspace graph. +.git +**/node_modules +**/.next +**/.nx +**/.turbo +**/dist +**/.artifacts +**/*.log diff --git a/cs-iam-login.base-version b/cs-iam-login.base-version new file mode 100644 index 00000000000..5a74a287689 --- /dev/null +++ b/cs-iam-login.base-version @@ -0,0 +1 @@ +v4.18.0 diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 09e97bb15f7..401c3e68cc1 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -289,6 +289,9 @@ importers: server-only: specifier: ^0.0.1 version: 0.0.1 + simple-icons: + specifier: ^16.23.0 + version: 16.32.0 tinycolor2: specifier: ^1.6.0 version: 1.6.0 @@ -966,6 +969,7 @@ packages: '@angular/animations@21.2.20': resolution: {integrity: sha512-H3Abe/dfPKNaGaoaqjrN9tZYNrAcoPnx5STLiAmpFSO4wz82/wwPO2mZCOBG4qjefredkNuuW/e+uuqZccXabw==} engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0} + deprecated: '@angular/animations is deprecated. Use `animate.enter` and `animate.leave` instead. For more information see: https://v22.angular.dev/guide/animations.' peerDependencies: '@angular/core': 21.2.20 @@ -1096,6 +1100,7 @@ packages: '@angular/platform-browser-dynamic@21.2.20': resolution: {integrity: sha512-n3+eLj0F/hjf+cgLaNWsBcqZcaeGoh5TCMe+VXUnh6XRwbwXorxP91ypfMT/rj0QnroY6NoZcvvPlx1ezsIVrw==} engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0} + deprecated: '@angular/platform-browser-dynamic is deprecated. Use `@angular/platform-browser` instead.' peerDependencies: '@angular/common': 21.2.20 '@angular/compiler': 21.2.20 @@ -10582,6 +10587,10 @@ packages: resolution: {integrity: sha512-endqECJkfhozrXMK5ngu/UAA0xVcVEFdnHJCElGaExypjW+HK5i6zu3NteLoaX/iFbRUbC3+DjttQs0GARr+5w==} engines: {node: ^20.17.0 || >=22.9.0} + simple-icons@16.32.0: + resolution: {integrity: sha512-BwqATHxAulx7X6kNdTkecy7PBjLkgtAHcgrwYLd9iA+cD2At9DzhJwdwaSELk2+aZe01IfiM/Wxtyp68Dvup2A==} + engines: {node: '>=0.12.18'} + simple-update-notifier@2.0.0: resolution: {integrity: sha512-a2B9Y0KlNXl9u/vsW6sTIu9vGEpfKu2wRV6l1H3XEas/0gUIzGzBoP/IouTcUQbm9JWZLH3COxyn03TYlFax6w==} engines: {node: '>=10'} @@ -23198,6 +23207,8 @@ snapshots: transitivePeerDependencies: - supports-color + simple-icons@16.32.0: {} + simple-update-notifier@2.0.0: dependencies: semver: 7.8.5 From 1b50f931ede2e74aab71dcbe120127e17e48c0d5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 12:47:35 +0000 Subject: [PATCH 2/2] chore(deps-dev): bump @faker-js/faker from 9.9.0 to 10.5.0 Bumps [@faker-js/faker](https://github.com/faker-js/faker) from 9.9.0 to 10.5.0. - [Release notes](https://github.com/faker-js/faker/releases) - [Changelog](https://github.com/faker-js/faker/blob/next/CHANGELOG.md) - [Commits](https://github.com/faker-js/faker/compare/v9.9.0...v10.5.0) --- updated-dependencies: - dependency-name: "@faker-js/faker" dependency-version: 10.5.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] --- apps/login/package.json | 2 +- pnpm-lock.yaml | 306 ++++++++++++++++++++++++++++++---------- 2 files changed, 233 insertions(+), 75 deletions(-) diff --git a/apps/login/package.json b/apps/login/package.json index f6fab6199c8..06a515098b3 100644 --- a/apps/login/package.json +++ b/apps/login/package.json @@ -61,7 +61,7 @@ }, "devDependencies": { "@eslint/js": "^10.0.1", - "@faker-js/faker": "^9.9.0", + "@faker-js/faker": "^10.5.0", "@next/eslint-plugin-next": "16.2.11", "@opentelemetry/sdk-trace-base": "^2.7.1", "@opentelemetry/sdk-trace-node": "^2.7.1", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 401c3e68cc1..43eb0cba7cc 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -23,7 +23,7 @@ importers: version: 1.72.0 '@changesets/cli': specifier: ^2.31.0 - version: 2.31.1(@types/node@25.9.5) + version: 2.31.1(@types/node@25.9.8) nx: specifier: 22.7.7 version: 22.7.7(@swc/core@1.15.47(@swc/helpers@0.5.23)) @@ -68,7 +68,7 @@ importers: version: 16.8.10(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.5)(@types/mdast@4.0.4)(@types/react@19.2.14)(algoliasearch@5.48.1)(lucide-react@0.577.0(react@19.2.6))(next@16.2.11(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@25.9.5)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(sass@1.102.0))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3) fumadocs-mdx: specifier: 14.3.2 - version: 14.3.2(@types/mdast@4.0.4)(@types/mdx@2.0.14)(@types/react@19.2.14)(fumadocs-core@16.8.10(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.5)(@types/mdast@4.0.4)(@types/react@19.2.14)(algoliasearch@5.48.1)(lucide-react@0.577.0(react@19.2.6))(next@16.2.11(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@25.9.5)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(sass@1.102.0))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3))(next@16.2.11(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@25.9.5)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(sass@1.102.0))(react@19.2.6)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0)) + version: 14.3.2(@types/mdast@4.0.4)(@types/mdx@2.0.14)(@types/react@19.2.14)(fumadocs-core@16.8.10(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.5)(@types/mdast@4.0.4)(@types/react@19.2.14)(algoliasearch@5.48.1)(lucide-react@0.577.0(react@19.2.6))(next@16.2.11(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@25.9.5)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(sass@1.102.0))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3))(next@16.2.11(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@25.9.5)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(sass@1.102.0))(react@19.2.6)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0)) fumadocs-openapi: specifier: 10.8.2 version: 10.8.2(108be02c366bc1b6f76806924276245b) @@ -306,8 +306,8 @@ importers: specifier: ^10.0.1 version: 10.0.1(eslint@10.8.1(jiti@2.7.0)) '@faker-js/faker': - specifier: ^9.9.0 - version: 9.9.0 + specifier: ^10.5.0 + version: 10.5.0 '@next/eslint-plugin-next': specifier: 16.2.11 version: 16.2.11 @@ -370,7 +370,7 @@ importers: version: 1.0.0 '@vitejs/plugin-react': specifier: ^4.7.0 - version: 4.7.0(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0)) + version: 4.7.0(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0)) '@zitadel/client': specifier: workspace:* version: link:../../packages/zitadel-client @@ -460,10 +460,10 @@ importers: version: 5.9.3 vite-tsconfig-paths: specifier: ^5.1.4 - version: 5.1.4(typescript@5.9.3)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0)) + version: 5.1.4(typescript@5.9.3)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0)) vitest: specifier: ^4.1.6 - version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(jsdom@26.1.0)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0)) + version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(jsdom@26.1.0)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0)) console: dependencies: @@ -611,7 +611,7 @@ importers: version: 21.4.0(eslint@10.8.1(jiti@2.7.0))(typescript@5.9.2) '@angular/build': specifier: ^21.2.19 - version: 21.2.21(fd596115c4757fc536449d80fd60e137) + version: 21.2.21(45ea1b76c60e95ad3bd6fa85bafe11dd) '@angular/cli': specifier: ^21.2.19 version: 21.2.21(@types/node@25.9.5)(chokidar@5.0.0) @@ -750,7 +750,7 @@ importers: devDependencies: '@bufbuild/protocompile': specifier: ^0.0.1 - version: 0.0.1(@bufbuild/buf@1.72.0) + version: 0.0.1(@bufbuild/buf@1.73.0) '@eslint/js': specifier: ^10.0.1 version: 10.0.1(eslint@10.8.1(jiti@2.7.0)) @@ -789,7 +789,7 @@ importers: version: 5.9.3 vitest: specifier: ^4.1.6 - version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(jsdom@26.1.0)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0)) + version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(jsdom@26.1.0)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0)) packages/zitadel-proto: dependencies: @@ -1245,47 +1245,94 @@ packages: cpu: [arm64] os: [darwin] + '@bufbuild/buf-darwin-arm64@1.73.0': + resolution: {integrity: sha512-cDd3y376ecClhyytNLlY3AtsZqsqXvEkQjMvrahrv/xUWWhEIX3efD8y0uufXDe8Yuk3sEmj7J1Xlx73Y46SkA==} + engines: {node: '>=12'} + cpu: [arm64] + os: [darwin] + '@bufbuild/buf-darwin-x64@1.72.0': resolution: {integrity: sha512-4TQ1AGft8sGspNg9NMsEjsKKis7nGaVV8tZLnNa3cKUBmx22gwOnB6VRhgKWwjf+BDqr85lUEzQ6wHCboNUutg==} engines: {node: '>=12'} cpu: [x64] os: [darwin] + '@bufbuild/buf-darwin-x64@1.73.0': + resolution: {integrity: sha512-VTBTCwaqT7otsMGXlk3MRu6x5hp+YH9PaLKcyWAa8wEt0NnMzbXdkE8GiLgI8Qkl7S3+pC9YSTCE/I+O87Fvrw==} + engines: {node: '>=12'} + cpu: [x64] + os: [darwin] + '@bufbuild/buf-linux-aarch64@1.72.0': resolution: {integrity: sha512-cbIsUcgM5bHhbZWcDaAXqaYOAi8N0c0u+NiDydwVmZ04Et3s1EZ3TDqfQDRzwvoBPDP+lsO6YuTRXX6nI28x4w==} engines: {node: '>=12'} cpu: [arm64] os: [linux] + '@bufbuild/buf-linux-aarch64@1.73.0': + resolution: {integrity: sha512-HjoQ3wbLiUv5N5XLM3EAR2FY51Yn6t5MEXLPnS/Hx0KDkK/5eyIBZZ6toHBLjczAr1RTA1LagF38+lglZI+kvA==} + engines: {node: '>=12'} + cpu: [arm64] + os: [linux] + '@bufbuild/buf-linux-armv7@1.72.0': resolution: {integrity: sha512-v/bXVsFL8YNm2HgosGb9r3+nAt4jQiUc3r3JipYuiVY3DAJZAjoEvcak6/BkxQMTEQz9Zb8gRRlule9IFkbc5g==} engines: {node: '>=12'} cpu: [arm] os: [linux] + '@bufbuild/buf-linux-armv7@1.73.0': + resolution: {integrity: sha512-NsZuVg8hXfGcR96Is14ArKxZg6pdJb6kb63bx2g7q8Cjo+gRqZMBFKGvF/fnQMxTrRQAm6hzeF4a2vV4W3lszg==} + engines: {node: '>=12'} + cpu: [arm] + os: [linux] + '@bufbuild/buf-linux-x64@1.72.0': resolution: {integrity: sha512-4xHGXEjqFxo1wX1zMGq4CzhYt5++nrj4C7k30j+YmGtvqCnipfdSe+V6kknBYRfYswVZEUwUbQOh6pnMTcGcrA==} engines: {node: '>=12'} cpu: [x64] os: [linux] + '@bufbuild/buf-linux-x64@1.73.0': + resolution: {integrity: sha512-dMe6lBQrlHTU7DzqzaR7Udky7R78EDzzxtYZQdjkZun9jKdjGR4fLbPWEPyY4rLGVyk6UUnrtkf5qoIK2SC6qw==} + engines: {node: '>=12'} + cpu: [x64] + os: [linux] + '@bufbuild/buf-win32-arm64@1.72.0': resolution: {integrity: sha512-WH7ClsoB9A0e/5fFhx0DLqLzillYPRdHBhlwzihgvjGci0bBdyJVHSQGf0B9uspCMU6sn6W/N1S9/2vvQBNMug==} engines: {node: '>=12'} cpu: [arm64] os: [win32] + '@bufbuild/buf-win32-arm64@1.73.0': + resolution: {integrity: sha512-UmubCflc8zJ48bVW0WeGeVTkNuumJP//wCWKUmeTXT1iNlEqkpaXy6y7o8YJKHGWLfX0/1UV3oay9ti0EyojMw==} + engines: {node: '>=12'} + cpu: [arm64] + os: [win32] + '@bufbuild/buf-win32-x64@1.72.0': resolution: {integrity: sha512-X3eWqFzhDmu8CYQZz+Fu7i+PgH+yUl8UwJ5+x+bhZRYAIdcijikthodk60c5u/qq42m1Z2XAnAGyp/mTf7IffA==} engines: {node: '>=12'} cpu: [x64] os: [win32] + '@bufbuild/buf-win32-x64@1.73.0': + resolution: {integrity: sha512-/Buo10rXzqNLnFDh3BpzGdcrx6OalcU8o8gUyObCFZA5wKcUvBVNDhhpMmoB6YeiOPpPn47jHgW4bSSlypaaOQ==} + engines: {node: '>=12'} + cpu: [x64] + os: [win32] + '@bufbuild/buf@1.72.0': resolution: {integrity: sha512-BwBKTX/WXkhAhqWJGrEKnqU03/4tK1O0OozSlwUMBCOEo8pLL3xu3M24RT3+umExEeM0wjlANO6axqGWMqtt4Q==} engines: {node: '>=12'} hasBin: true + '@bufbuild/buf@1.73.0': + resolution: {integrity: sha512-W3whb4P1y3Hs9bqwCu9++W1v1ofHZ3dBUCe6JSZq0Ff5OK5UKKZuMN4iunPbgdyXY4+4ujEYf2ESrN/6MbcFSQ==} + engines: {node: '>=12'} + hasBin: true + '@bufbuild/protobuf@2.13.0': resolution: {integrity: sha512-acq7c49vxfm1ggJ95P70TX7ABDM0vxr1SYD3BB0o0jnBLB4OAqeHyKuN+cD3w80gXEDQ2zxHpR6CUeA+O/aU9g==} @@ -1878,9 +1925,9 @@ packages: resolution: {integrity: sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A==} engines: {node: ^20.19.0 || ^22.13.0 || >=24} - '@faker-js/faker@9.9.0': - resolution: {integrity: sha512-OEl393iCOoo/z8bMezRlJu+GlRGlsKbUAN7jKB6LhnKoqKve5DXRpalbItIIcwnCjs1k/FOPjFzcA6Qn+H+YbA==} - engines: {node: '>=18.0.0', npm: '>=9.0.0'} + '@faker-js/faker@10.5.0': + resolution: {integrity: sha512-bsxD8WLS5lIj7aaoCx1YJkktqYj5vlBUE6HWzu2Q51ksrGJ0H737ECCKlFU7Yf8Br45z9t99frBp/J7kzbMPAg==} + engines: {node: ^20.19.0 || ^22.13.0 || ^23.5.0 || >=24.0.0, npm: '>=10'} '@floating-ui/core@1.8.0': resolution: {integrity: sha512-0CIZ5itps/8x7BG8dEIhs53BvCUH2PCoogtakwRTut+Arm58sJooJ0AuZhLw2HJYIR5cMLNPBSS728sPho2khQ==} @@ -5396,6 +5443,9 @@ packages: '@types/node@25.9.5': resolution: {integrity: sha512-OScDchr2fwuUmWdf4kZ9h7PcJiYDVInhJizG/biAq3cAvqwYktuy/TYGGdZNMtNTFUP7rnb0NU4TUdm82kt4Rg==} + '@types/node@25.9.8': + resolution: {integrity: sha512-VfMrScDmMhUJQmd5hArdQnFvK0OIeD36uN2Va1FcpYaLB/BgkgM8Ulc50XtYISPMz7APJ30+N0T5EM0jlcdfRw==} + '@types/normalize-package-data@2.4.4': resolution: {integrity: sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA==} @@ -5981,14 +6031,6 @@ packages: peerDependencies: zod: ^3.25.76 || ^4.1.8 - ajv-formats@2.1.1: - resolution: {integrity: sha512-Wx0Kx52hxE7C18hkMEggYlEifqWZtYaRgouJor+WMdPnQyEK13vgEWyVNup7SoeeoLMsr4kf5h6dOW11I15MUA==} - peerDependencies: - ajv: ^8.0.0 - peerDependenciesMeta: - ajv: - optional: true - ajv-formats@3.0.1: resolution: {integrity: sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==} peerDependencies: @@ -6253,6 +6295,11 @@ packages: engines: {node: '>=6.0.0'} hasBin: true + baseline-browser-mapping@2.11.25: + resolution: {integrity: sha512-gMmEShwwq7FJqMwvfRwvCl00v4kN+KOfJqXn+f4nrufak5gNHJOksd/60Dvjuz7sI8Y5WiSFBa8FEYr+zoyqCw==} + engines: {node: '>=6.0.0'} + hasBin: true + bcrypt-pbkdf@1.0.2: resolution: {integrity: sha512-qeFIXtP4MSoi6NLqO12WfqARWWuCKi2Rn/9hJLEmtB5yTNr9DqFWkJRCf2qShWzPeAMRnOgCrq0sg/KLv5ES9w==} @@ -6313,6 +6360,11 @@ packages: engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7} hasBin: true + browserslist@4.29.0: + resolution: {integrity: sha512-3GSvyjvDI4Dur1Meg2BekJquu5uF+9R9a1+5M1Mde192eZoXbeXjzgOsgqPS2V8D5wrrip0gR5Hf/GhWQ9ZzaA==} + engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7} + hasBin: true + buffer-crc32@1.0.0: resolution: {integrity: sha512-Db1SbgBS/fg/392AblrMJk97KggmvYhr4pB5ZIMTWtaivCPMWLkmb7m21cJvpvgK+J3nsU2CmmixNBZx4vFj/w==} engines: {node: '>=8.0.0'} @@ -6378,6 +6430,9 @@ packages: caniuse-lite@1.0.30001809: resolution: {integrity: sha512-xxWVywk6a6Arlk+hymeycyn/VgqEfLDxupvhH/xiY5SJ/18kmi9o6MiO320DCUzypORHLtvh0I4i04tUhCNHNQ==} + caniuse-lite@1.0.30001810: + resolution: {integrity: sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==} + case-anything@2.1.13: resolution: {integrity: sha512-zlOQ80VrQ2Ue+ymH5OuM/DlDq64mEm+B9UTdHULv5osUMD6HalNTblf2b1u/m6QecjsnOkBpqVZ+XPwIVsy7Ng==} engines: {node: '>=12.13'} @@ -6942,6 +6997,9 @@ packages: electron-to-chromium@1.5.405: resolution: {integrity: sha512-bNglH7lPH5l+yHOes7Zr4VqxhOy4BQ9ZBUX4VdoFgxMpzJk7W1ZoO3Vgd9Pxa9PyjQ76sfm2aKH/nzEcCNRlew==} + electron-to-chromium@1.5.433: + resolution: {integrity: sha512-5lCAbyZBjtmUt/RAGHRqrL2q0oEFRThDAsZHHDn9XHa89Qw7gMYOeSicBTy+AHfvo0r6vwsZvqNJTQIQy1BLzA==} + emoji-regex@10.6.0: resolution: {integrity: sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==} @@ -6981,6 +7039,10 @@ packages: resolution: {integrity: sha512-L1l8TNvomm6UVW5B253AGxQagSQr+vGwhMlrrfRS2qmhx46AMpMVJKQYLvWYbysTMY8VoicOvzHzoHMbyzB+4A==} engines: {node: '>=10.13.0'} + enhanced-resolve@5.25.1: + resolution: {integrity: sha512-nGXts5znJzmWPu+mIE9izCOzdg63oJca2mDzGWWTth7sr4aCToKcoyFVBQwN75Ij5Pf6p510EwkTqViTRzDV+w==} + engines: {node: '>=10.13.0'} + enquirer@2.3.6: resolution: {integrity: sha512-yjNnPr315/FjS4zIsUxYguYUPP2e1NK4d7E7ZOLiyYCcbFBiTMyID+2wvm2w6+pZ/odMA7cRkjhsPbltwBOrLg==} engines: {node: '>=8.6'} @@ -7050,6 +7112,9 @@ packages: es-module-lexer@2.3.1: resolution: {integrity: sha512-shc1dbU90Yl/xq1QrC7QRtfcwURZuVRfPhZbDoldJ1cn1gzDvBaBWlv0eFolj5+0znnPJz5TXLxsN77X/12KTA==} + es-module-lexer@2.3.2: + resolution: {integrity: sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==} + es-object-atoms@1.1.1: resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==} engines: {node: '>= 0.4'} @@ -9114,11 +9179,12 @@ packages: minimist@1.2.8: resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==} - minimizer-webpack-plugin@5.6.1: - resolution: {integrity: sha512-DoeAZz8Q1C1znwsUzej1fdoi4jCf7/+Em27ouLqfK/+3m8G+D7yDhUwrc3CNhjSzGUN1kn7Iv4sWmjflQHenpw==} + minimizer-webpack-plugin@5.11.0: + resolution: {integrity: sha512-2JVy2DY+iBtfRyrQB5cRM7lfurnJIi6jFTgLip/7FxDu0WxswrIRzr4fBySQ0X7HqM7BcwE28zm+HfQ5V6y4Cg==} engines: {node: '>= 10.13.0'} peerDependencies: '@minify-html/node': '*' + '@napi-rs/image': '*' '@swc/core': '*' '@swc/css': '*' '@swc/html': '*' @@ -9127,13 +9193,18 @@ packages: csso: '*' esbuild: '*' html-minifier-terser: '*' + imagemin: '*' lightningcss: '*' postcss: '*' + sharp: '*' + svgo: '*' uglify-js: '*' webpack: ^5.1.0 peerDependenciesMeta: '@minify-html/node': optional: true + '@napi-rs/image': + optional: true '@swc/core': optional: true '@swc/css': @@ -9150,10 +9221,16 @@ packages: optional: true html-minifier-terser: optional: true + imagemin: + optional: true lightningcss: optional: true postcss: optional: true + sharp: + optional: true + svgo: + optional: true uglify-js: optional: true @@ -9410,6 +9487,10 @@ packages: resolution: {integrity: sha512-D9UOmYG3UH1V+ENW56t5QXBwJw1YEY18ruVeus89Rw+SyIgjPkCO84bRzO3uNIYosJbNwiabWVn48o3uJLjxFQ==} engines: {node: '>=18'} + node-releases@2.0.56: + resolution: {integrity: sha512-x0InOIyzgdk+eyaWaRJFH5snEtiImgBgblZ2CyPrLmqqcuMQkEvcDPHbzqbD8eDsSeJbVOjn+crzyzHaM4D+/A==} + engines: {node: '>=18'} + nodemon@3.1.14: resolution: {integrity: sha512-jakjZi93UtB3jHMWsXL68FXSAosbLfY0In5gtKq3niLSkrWznrVBzXFNOEMJUfc9+Ke7SHWoAZsiMkNP3vq6Jw==} engines: {node: '>=10'} @@ -10472,8 +10553,8 @@ packages: resolution: {integrity: sha512-pN/yOAvcC+5rQ5nERGuwrjLlYvLTbCibnZ1I7B1LaiAz9BRBlE9GMgE/eqV30P7aJQUf7Ddimy/RsbYO/GrVGg==} engines: {node: '>= 10.13.0'} - schema-utils@4.3.3: - resolution: {integrity: sha512-eflK8wEtyOE6+hsaRVPxvUKYCpRgzLqDTb8krvAsRIwOGlHoSgYLgBXoubGgLd2fT41/OUYdb48v4k4WWHQurA==} + schema-utils@4.5.0: + resolution: {integrity: sha512-zJlMCZ0cAR5p/Y4oVpRoqioDMJcGxaXRrQ/4rP4WyR84vc5z/DolXdbvXeDpTwbtocDFr2rhPqHPErDCUtz2kA==} engines: {node: '>= 10.13.0'} scroll-into-view-if-needed@3.1.0: @@ -10949,8 +11030,8 @@ packages: resolution: {integrity: sha512-wK0Ri4fOGjv/XPy8SBHZChl8CM7uMc5VML7SqiQ0zG7+J5Vr+RMQDoHa2CNT6KHUnTGIXH34UDMkPzAUyapBZg==} engines: {node: '>=8'} - terser@5.50.0: - resolution: {integrity: sha512-CN9BVxWhgS/hRxtUMjtC2uRWSTcSfQFHMDWma6sKKfIivCD91sM+FOPfvwoaRMqCSrUpe1nv3jDamd9eEQ4y+w==} + terser@5.51.2: + resolution: {integrity: sha512-bWnjSNscmuI+GJze6ZupnHP8G/cTcsJF+bXCeQknk2SHQsgbNJnLrqiH9jZ2W4STPVXH2mDKKRX3iwPhc9Cn/Q==} engines: {node: '>=10'} hasBin: true @@ -11312,6 +11393,12 @@ packages: peerDependencies: browserslist: '>= 4.21.0' + update-browserslist-db@1.3.3: + resolution: {integrity: sha512-pJ2sYawQS0R/WI928Gj5GlPhTGzbMelq0+4INtSYNDV9ErKJcX6xjGWkoG/VnB3dpUm00zALaqkrUD77pO5TDQ==} + hasBin: true + peerDependencies: + browserslist: '>= 4.21.0' + uri-js@4.4.1: resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==} @@ -12041,7 +12128,7 @@ snapshots: '@angular/core': 21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.16.2) tslib: 2.8.1 - '@angular/build@21.2.21(fd596115c4757fc536449d80fd60e137)': + '@angular/build@21.2.21(45ea1b76c60e95ad3bd6fa85bafe11dd)': dependencies: '@ampproject/remapping': 2.3.0 '@angular-devkit/architect': 0.2102.21(chokidar@5.0.0) @@ -12051,7 +12138,7 @@ snapshots: '@babel/helper-annotate-as-pure': 7.27.3 '@babel/helper-split-export-declaration': 7.24.7 '@inquirer/confirm': 5.1.21(@types/node@25.9.5) - '@vitejs/plugin-basic-ssl': 2.1.4(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0)) + '@vitejs/plugin-basic-ssl': 2.1.4(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0)) beasties: 0.4.1 browserslist: 4.28.8 esbuild: 0.28.1 @@ -12072,7 +12159,7 @@ snapshots: tslib: 2.8.1 typescript: 5.9.2 undici: 7.29.0 - vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0) + vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0) watchpack: 2.5.1 optionalDependencies: '@angular/core': 21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.16.2) @@ -12082,7 +12169,7 @@ snapshots: lmdb: 3.5.1 postcss: 8.5.26 tailwindcss: 4.3.3 - vitest: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(jsdom@26.1.0)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0)) + vitest: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(jsdom@26.1.0)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0)) transitivePeerDependencies: - '@emnapi/core' - '@emnapi/runtime' @@ -12362,24 +12449,45 @@ snapshots: '@bufbuild/buf-darwin-arm64@1.72.0': optional: true + '@bufbuild/buf-darwin-arm64@1.73.0': + optional: true + '@bufbuild/buf-darwin-x64@1.72.0': optional: true + '@bufbuild/buf-darwin-x64@1.73.0': + optional: true + '@bufbuild/buf-linux-aarch64@1.72.0': optional: true + '@bufbuild/buf-linux-aarch64@1.73.0': + optional: true + '@bufbuild/buf-linux-armv7@1.72.0': optional: true + '@bufbuild/buf-linux-armv7@1.73.0': + optional: true + '@bufbuild/buf-linux-x64@1.72.0': optional: true + '@bufbuild/buf-linux-x64@1.73.0': + optional: true + '@bufbuild/buf-win32-arm64@1.72.0': optional: true + '@bufbuild/buf-win32-arm64@1.73.0': + optional: true + '@bufbuild/buf-win32-x64@1.72.0': optional: true + '@bufbuild/buf-win32-x64@1.73.0': + optional: true + '@bufbuild/buf@1.72.0': optionalDependencies: '@bufbuild/buf-darwin-arm64': 1.72.0 @@ -12390,6 +12498,16 @@ snapshots: '@bufbuild/buf-win32-arm64': 1.72.0 '@bufbuild/buf-win32-x64': 1.72.0 + '@bufbuild/buf@1.73.0': + optionalDependencies: + '@bufbuild/buf-darwin-arm64': 1.73.0 + '@bufbuild/buf-darwin-x64': 1.73.0 + '@bufbuild/buf-linux-aarch64': 1.73.0 + '@bufbuild/buf-linux-armv7': 1.73.0 + '@bufbuild/buf-linux-x64': 1.73.0 + '@bufbuild/buf-win32-arm64': 1.73.0 + '@bufbuild/buf-win32-x64': 1.73.0 + '@bufbuild/protobuf@2.13.0': {} '@bufbuild/protoc-gen-es@2.13.0(@bufbuild/protobuf@2.13.0)': @@ -12400,9 +12518,9 @@ snapshots: transitivePeerDependencies: - supports-color - '@bufbuild/protocompile@0.0.1(@bufbuild/buf@1.72.0)': + '@bufbuild/protocompile@0.0.1(@bufbuild/buf@1.73.0)': dependencies: - '@bufbuild/buf': 1.72.0 + '@bufbuild/buf': 1.73.0 '@bufbuild/protobuf': 2.13.0 fflate: 0.8.3 @@ -12473,7 +12591,7 @@ snapshots: dependencies: '@changesets/types': 6.1.0 - '@changesets/cli@2.31.1(@types/node@25.9.5)': + '@changesets/cli@2.31.1(@types/node@25.9.8)': dependencies: '@changesets/apply-release-plan': 7.1.1 '@changesets/assemble-release-plan': 6.0.10 @@ -12489,7 +12607,7 @@ snapshots: '@changesets/should-skip-package': 0.1.2 '@changesets/types': 6.1.0 '@changesets/write': 0.4.0 - '@inquirer/external-editor': 1.0.3(@types/node@25.9.5) + '@inquirer/external-editor': 1.0.3(@types/node@25.9.8) '@manypkg/get-packages': 1.1.3 ansi-colors: 4.1.3 enquirer: 2.4.1 @@ -13006,7 +13124,7 @@ snapshots: '@eslint/core': 1.2.1 levn: 0.4.1 - '@faker-js/faker@9.9.0': {} + '@faker-js/faker@10.5.0': {} '@floating-ui/core@1.8.0': dependencies: @@ -13448,6 +13566,13 @@ snapshots: optionalDependencies: '@types/node': 25.9.5 + '@inquirer/external-editor@1.0.3(@types/node@25.9.8)': + dependencies: + chardet: 2.2.0 + iconv-lite: 0.7.3 + optionalDependencies: + '@types/node': 25.9.8 + '@inquirer/figures@1.0.15': {} '@inquirer/input@4.3.1(@types/node@25.9.5)': @@ -16779,6 +16904,10 @@ snapshots: dependencies: undici-types: 7.24.6 + '@types/node@25.9.8': + dependencies: + undici-types: 7.24.6 + '@types/normalize-package-data@2.4.4': {} '@types/opentype.js@1.3.10': {} @@ -17124,11 +17253,11 @@ snapshots: '@vercel/oidc@3.1.0': {} - '@vitejs/plugin-basic-ssl@2.1.4(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0))': + '@vitejs/plugin-basic-ssl@2.1.4(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0))': dependencies: - vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0) + vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0) - '@vitejs/plugin-react@4.7.0(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0))': + '@vitejs/plugin-react@4.7.0(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0))': dependencies: '@babel/core': 7.29.7 '@babel/plugin-transform-react-jsx-self': 7.29.7(@babel/core@7.29.7) @@ -17136,7 +17265,7 @@ snapshots: '@rolldown/pluginutils': 1.0.0-beta.27 '@types/babel__core': 7.20.5 react-refresh: 0.17.0 - vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0) + vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0) transitivePeerDependencies: - supports-color @@ -17149,21 +17278,21 @@ snapshots: chai: 6.2.2 tinyrainbow: 3.1.1 - '@vitest/mocker@4.1.10(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0))': + '@vitest/mocker@4.1.10(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0))': dependencies: '@vitest/spy': 4.1.10 estree-walker: 3.0.3 magic-string: 0.30.21 optionalDependencies: - vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0) + vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0) - '@vitest/mocker@4.1.10(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0))': + '@vitest/mocker@4.1.10(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0))': dependencies: '@vitest/spy': 4.1.10 estree-walker: 3.0.3 magic-string: 0.30.21 optionalDependencies: - vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0) + vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0) optional: true '@vitest/pretty-format@4.1.10': @@ -17503,10 +17632,6 @@ snapshots: '@opentelemetry/api': 1.9.0 zod: 4.4.3 - ajv-formats@2.1.1(ajv@8.20.0): - optionalDependencies: - ajv: 8.20.0 - ajv-formats@3.0.1(ajv@8.18.0): optionalDependencies: ajv: 8.18.0 @@ -17795,6 +17920,8 @@ snapshots: baseline-browser-mapping@2.11.13: {} + baseline-browser-mapping@2.11.25: {} + bcrypt-pbkdf@1.0.2: dependencies: tweetnacl: 0.14.5 @@ -17889,6 +18016,14 @@ snapshots: node-releases: 2.0.53 update-browserslist-db: 1.3.1(browserslist@4.28.8) + browserslist@4.29.0: + dependencies: + baseline-browser-mapping: 2.11.25 + caniuse-lite: 1.0.30001810 + electron-to-chromium: 1.5.433 + node-releases: 2.0.56 + update-browserslist-db: 1.3.3(browserslist@4.29.0) + buffer-crc32@1.0.0: {} buffer-equal-constant-time@1.0.1: {} @@ -17955,6 +18090,8 @@ snapshots: caniuse-lite@1.0.30001809: {} + caniuse-lite@1.0.30001810: {} + case-anything@2.1.13: {} caseless@0.12.0: {} @@ -18518,6 +18655,8 @@ snapshots: electron-to-chromium@1.5.405: {} + electron-to-chromium@1.5.433: {} + emoji-regex@10.6.0: {} emoji-regex@8.0.0: {} @@ -18560,6 +18699,11 @@ snapshots: graceful-fs: 4.2.11 tapable: 2.3.3 + enhanced-resolve@5.25.1: + dependencies: + graceful-fs: 4.2.11 + tapable: 2.3.3 + enquirer@2.3.6: dependencies: ansi-colors: 4.1.3 @@ -18674,6 +18818,8 @@ snapshots: es-module-lexer@2.3.1: {} + es-module-lexer@2.3.2: {} + es-object-atoms@1.1.1: dependencies: es-errors: 1.3.0 @@ -19423,7 +19569,7 @@ snapshots: transitivePeerDependencies: - supports-color - fumadocs-mdx@14.3.2(@types/mdast@4.0.4)(@types/mdx@2.0.14)(@types/react@19.2.14)(fumadocs-core@16.8.10(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.5)(@types/mdast@4.0.4)(@types/react@19.2.14)(algoliasearch@5.48.1)(lucide-react@0.577.0(react@19.2.6))(next@16.2.11(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@25.9.5)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(sass@1.102.0))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3))(next@16.2.11(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@25.9.5)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(sass@1.102.0))(react@19.2.6)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0)): + fumadocs-mdx@14.3.2(@types/mdast@4.0.4)(@types/mdx@2.0.14)(@types/react@19.2.14)(fumadocs-core@16.8.10(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.5)(@types/mdast@4.0.4)(@types/react@19.2.14)(algoliasearch@5.48.1)(lucide-react@0.577.0(react@19.2.6))(next@16.2.11(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@25.9.5)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(sass@1.102.0))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3))(next@16.2.11(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@25.9.5)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(sass@1.102.0))(react@19.2.6)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0)): dependencies: '@mdx-js/mdx': 3.1.1 '@standard-schema/spec': 1.1.0 @@ -19449,7 +19595,7 @@ snapshots: '@types/react': 19.2.14 next: 16.2.11(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.62.1)(@types/node@25.9.5)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(sass@1.102.0) react: 19.2.6 - vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0) + vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0) transitivePeerDependencies: - supports-color @@ -20369,7 +20515,7 @@ snapshots: jest-worker@27.5.1: dependencies: - '@types/node': 25.9.5 + '@types/node': 25.9.8 merge-stream: 2.0.0 supports-color: 8.1.1 @@ -21368,12 +21514,12 @@ snapshots: minimist@1.2.8: {} - minimizer-webpack-plugin@5.6.1(@swc/core@1.15.47(@swc/helpers@0.5.23))(lightningcss@1.32.0)(postcss@8.5.26)(webpack@5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(lightningcss@1.32.0)(postcss@8.5.26)): + minimizer-webpack-plugin@5.11.0(@swc/core@1.15.47(@swc/helpers@0.5.23))(lightningcss@1.32.0)(postcss@8.5.26)(webpack@5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(lightningcss@1.32.0)(postcss@8.5.26)): dependencies: '@jridgewell/trace-mapping': 0.3.31 jest-worker: 27.5.1 - schema-utils: 4.3.3 - terser: 5.50.0 + schema-utils: 4.5.0 + terser: 5.51.2 webpack: 5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(lightningcss@1.32.0)(postcss@8.5.26) optionalDependencies: '@swc/core': 1.15.47(@swc/helpers@0.5.23) @@ -21641,6 +21787,8 @@ snapshots: node-releases@2.0.53: {} + node-releases@2.0.56: {} + nodemon@3.1.14: dependencies: chokidar: 3.6.0 @@ -23024,11 +23172,11 @@ snapshots: ajv: 6.15.0 ajv-keywords: 3.5.2(ajv@6.15.0) - schema-utils@4.3.3: + schema-utils@4.5.0: dependencies: '@types/json-schema': 7.0.15 ajv: 8.20.0 - ajv-formats: 2.1.1(ajv@8.20.0) + ajv-formats: 3.0.1(ajv@8.20.0) ajv-keywords: 5.1.0(ajv@8.20.0) scroll-into-view-if-needed@3.1.0: @@ -23631,7 +23779,7 @@ snapshots: term-size@2.2.1: {} - terser@5.50.0: + terser@5.51.2: dependencies: '@jridgewell/source-map': 0.3.11 acorn: 8.18.0 @@ -24071,6 +24219,12 @@ snapshots: escalade: 3.2.0 picocolors: 1.1.1 + update-browserslist-db@1.3.3(browserslist@4.29.0): + dependencies: + browserslist: 4.29.0 + escalade: 3.2.0 + picocolors: 1.1.1 + uri-js@4.4.1: dependencies: punycode: 2.3.1 @@ -24184,18 +24338,18 @@ snapshots: '@types/unist': 3.0.3 vfile-message: 4.0.3 - vite-tsconfig-paths@5.1.4(typescript@5.9.3)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0)): + vite-tsconfig-paths@5.1.4(typescript@5.9.3)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0)): dependencies: debug: 4.4.3(supports-color@7.2.0) globrex: 0.1.2 tsconfck: 3.1.6(typescript@5.9.3) optionalDependencies: - vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0) + vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0) transitivePeerDependencies: - supports-color - typescript - vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0): + vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0): dependencies: esbuild: 0.28.2 fdir: 6.5.0(picomatch@4.0.4) @@ -24209,11 +24363,11 @@ snapshots: jiti: 2.7.0 lightningcss: 1.32.0 sass: 1.102.0 - terser: 5.50.0 + terser: 5.51.2 tsx: 4.21.0 yaml: 2.9.0 - vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0): + vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0): dependencies: esbuild: 0.28.2 fdir: 6.5.0(picomatch@4.0.4) @@ -24227,14 +24381,14 @@ snapshots: jiti: 2.7.0 lightningcss: 1.32.0 sass: 1.97.3 - terser: 5.50.0 + terser: 5.51.2 tsx: 4.21.0 yaml: 2.9.0 - vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(jsdom@26.1.0)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0)): + vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(jsdom@26.1.0)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0)): dependencies: '@vitest/expect': 4.1.10 - '@vitest/mocker': 4.1.10(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0)) + '@vitest/mocker': 4.1.10(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0)) '@vitest/pretty-format': 4.1.10 '@vitest/runner': 4.1.10 '@vitest/snapshot': 4.1.10 @@ -24251,7 +24405,7 @@ snapshots: tinyexec: 1.3.0 tinyglobby: 0.2.17 tinyrainbow: 3.1.1 - vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0) + vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.102.0)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0) why-is-node-running: 2.3.0 optionalDependencies: '@opentelemetry/api': 1.9.1 @@ -24260,10 +24414,10 @@ snapshots: transitivePeerDependencies: - msw - vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(jsdom@26.1.0)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0)): + vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(jsdom@26.1.0)(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0)): dependencies: '@vitest/expect': 4.1.10 - '@vitest/mocker': 4.1.10(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0)) + '@vitest/mocker': 4.1.10(vite@7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0)) '@vitest/pretty-format': 4.1.10 '@vitest/runner': 4.1.10 '@vitest/snapshot': 4.1.10 @@ -24280,7 +24434,7 @@ snapshots: tinyexec: 1.3.0 tinyglobby: 0.2.17 tinyrainbow: 3.1.1 - vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.50.0)(tsx@4.21.0)(yaml@2.9.0) + vite: 7.3.6(@types/node@25.9.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.97.3)(terser@5.51.2)(tsx@4.21.0)(yaml@2.9.0) why-is-node-running: 2.3.0 optionalDependencies: '@opentelemetry/api': 1.9.1 @@ -24373,22 +24527,23 @@ snapshots: '@webassemblyjs/wasm-edit': 1.14.1 '@webassemblyjs/wasm-parser': 1.14.1 acorn: 8.18.0 - browserslist: 4.28.8 + browserslist: 4.29.0 chrome-trace-event: 1.0.4 - enhanced-resolve: 5.24.5 - es-module-lexer: 2.3.1 + enhanced-resolve: 5.25.1 + es-module-lexer: 2.3.2 eslint-scope: 5.1.1 events: 3.3.0 graceful-fs: 4.2.11 mime-db: 1.54.0 - minimizer-webpack-plugin: 5.6.1(@swc/core@1.15.47(@swc/helpers@0.5.23))(lightningcss@1.32.0)(postcss@8.5.26)(webpack@5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(lightningcss@1.32.0)(postcss@8.5.26)) + minimizer-webpack-plugin: 5.11.0(@swc/core@1.15.47(@swc/helpers@0.5.23))(lightningcss@1.32.0)(postcss@8.5.26)(webpack@5.109.2(@swc/core@1.15.47(@swc/helpers@0.5.23))(lightningcss@1.32.0)(postcss@8.5.26)) neo-async: 2.6.2 - schema-utils: 4.3.3 + schema-utils: 4.5.0 tapable: 2.3.3 watchpack: 2.5.2 webpack-sources: 3.5.1 transitivePeerDependencies: - '@minify-html/node' + - '@napi-rs/image' - '@swc/core' - '@swc/css' - '@swc/html' @@ -24397,8 +24552,11 @@ snapshots: - csso - esbuild - html-minifier-terser + - imagemin - lightningcss - postcss + - sharp + - svgo - uglify-js whatwg-encoding@3.1.1: