@mnemonik/cli 7.141.0 → 7.141.2

package/dist/runtime/signers.js

@@ -890,6 +890,61 @@ var init_protectedPaths = __esm({
 });
 
 // packages/shared/dist/secretPatterns.js
+function redactSecretValue(value) {
+  return SECRET_REDACTION_PLACEHOLDER + (value.match(/\\(?:\r\n|[\r\n])|\r\n|[\r\n]|\\[rn]/g)?.join("") ?? "");
+}
+function redactLabeledValues(text) {
+  let result = "";
+  let offset = 0;
+  LABELED_VALUE_RE.lastIndex = 0;
+  for (const match of text.matchAll(LABELED_VALUE_RE)) {
+    if (match.index < offset)
+      continue;
+    const start = match.index + match[0].length;
+    const escaped = text[start] === "\\" && /^["']/.test(text.charAt(start + 1));
+    const quote2 = escaped ? text.charAt(start + 1) : /^["'`]/.test(text.charAt(start)) ? text.charAt(start) : "";
+    const delimiter = (escaped ? "\\" : "") + quote2;
+    let end = start;
+    let closed = false;
+    if (quote2) {
+      end += delimiter.length;
+      while (end < text.length) {
+        if (text[end] === "\\") {
+          if (escaped) {
+            const begin = end;
+            while (text[end] === "\\")
+              end++;
+            if (text[end] === quote2 && (end - begin) % 4 === 1) {
+              end++;
+              closed = true;
+              break;
+            }
+            end = Math.min(end + 1, text.length);
+          } else {
+            end = Math.min(end + 2, text.length);
+          }
+        } else if (text[end++] === quote2 && !escaped) {
+          closed = true;
+          break;
+        }
+      }
+    } else {
+      end += /^(?:\\[^\r\n]|[^\s"'`,;()[\]{}\\])+/.exec(text.slice(start))?.[0].length ?? 0;
+    }
+    const value = text.slice(start, end);
+    if (!/[A-Za-z0-9]/.test(value) || ENV_READ_VALUE_RE.test(match[0] + value))
+      continue;
+    if (quote2 && !escaped && (text[match.index - 1] === quote2 || text[match.index - 1] === "^" && text[match.index - 2] === quote2 && (start + 1 === text.length || /\s/.test(text.charAt(start + 1)))))
+      continue;
+    if (/aws_secret_access_key/i.test(match[0]) && /^<[^>]*>$/.test(value))
+      continue;
+    const body = quote2 ? value.slice(delimiter.length, closed ? -delimiter.length : void 0) : value.replace(/(?:\*\/|[.!?]+)$/, "");
+    const tail = quote2 ? closed ? delimiter : "" : value.slice(body.length);
+    result += text.slice(offset, start) + delimiter + redactSecretValue(body) + tail;
+    offset = end;
+  }
+  return result + text.slice(offset);
+}
 function shannonEntropy(token) {
   const counts = /* @__PURE__ */ new Map();
   for (const ch of token)
@@ -950,17 +1005,25 @@ function scrubSecrets(text) {
     return text;
   let result = text;
   for (const pattern of SECRET_PATTERNS) {
-    result = result.replace(pattern, (match) => ENV_READ_VALUE_RE.test(match) ? match : SECRET_REDACTION_PLACEHOLDER);
+    if (pattern === LABELED_VALUE_RE) {
+      result = redactLabeledValues(result);
+    } else {
+      result = result.replace(pattern, (match) => ENV_READ_VALUE_RE.test(match) ? match : redactSecretValue(match));
+    }
   }
   return redactHighEntropyTokens(result);
 }
-var SECRET_REDACTION_PLACEHOLDER, SECRET_PATTERNS, ENV_READ_VALUE_RE, ENTROPY_MIN_LENGTH, ENTROPY_MIN_BITS_PER_CHAR, ENTROPY_MAX_STRUCTURED_SEGMENT, ENTROPY_MAX_LOWERCASE_RUN, ENTROPY_CANDIDATE_RE, ENTROPY_CONTEXT_RE, ENTROPY_OPERATOR_TAIL_RE, ENTROPY_HEXISH_RE, ENTROPY_STRUCTURED_RE;
+var SECRET_REDACTION_PLACEHOLDER, SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE, SECRET_PATTERNS, ENV_READ_VALUE_RE, ENTROPY_MIN_LENGTH, ENTROPY_MIN_BITS_PER_CHAR, ENTROPY_MAX_STRUCTURED_SEGMENT, ENTROPY_MAX_LOWERCASE_RUN, ENTROPY_CANDIDATE_RE, ENTROPY_CONTEXT_RE, ENTROPY_OPERATOR_TAIL_RE, ENTROPY_HEXISH_RE, ENTROPY_STRUCTURED_RE;
 var init_secretPatterns = __esm({
   "packages/shared/dist/secretPatterns.js"() {
     "use strict";
     SECRET_REDACTION_PLACEHOLDER = "[REDACTED]";
+    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
+    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
+    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
     SECRET_PATTERNS = [
-      /(?:api[_-]?key|secret|token|password|credential|auth)\s*[:=]\s*(?=\S*[A-Za-z0-9])\S+/gi,
+      LABELED_VALUE_RE,
+      // Select the label; the linear reader consumes its complete value.
       // Stripe-shape: (sk|pk)_(live|test)_<24+ alphanumerics>. Catches modern
       // Stripe keys whose body is split by an environment separator that
       // breaks the contiguous-alphanum pattern below. Required `live|test`
@@ -981,10 +1044,7 @@ var init_secretPatterns = __esm({
       // \b-delimited, so prose ("AKIAMIA is a place name") cannot match.
       /\bAKIA[0-9A-Z]{16}\b/g,
       /\bASIA[0-9A-Z]{16}\b/g,
-      // AWS secret access key, labeled. The generic key=value pattern above does
-      // NOT cover this: its `secret` alternative must be followed immediately by
-      // `[:=]`, and here it is followed by `_access_key`.
-      /\baws_secret_access_key\s*[:=]\s*[A-Za-z0-9/+=]{40}\b/gi,
+      // Labeled AWS secret access keys are covered by LABELED_VALUE_RE, including quotes.
       // JWT: three base64url segments. Length minimums keep dotted identifiers
       // (`payload.header.signature`) out.
       /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}\b/g,

package/dist/runtime/store.js

@@ -435,9 +435,13 @@ var init_protectedPaths = __esm({
 });
 
 // packages/shared/dist/secretPatterns.js
+var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
 var init_secretPatterns = __esm({
   "packages/shared/dist/secretPatterns.js"() {
     "use strict";
+    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
+    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
+    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
   }
 });
 

package/dist/runtime/updateCheck.js

@@ -886,9 +886,13 @@ var require_ignore = __commonJS({
 });
 
 // packages/shared/dist/secretPatterns.js
+var SECRET_LABEL, SECRET_LABEL_RE, LABELED_VALUE_RE;
 var init_secretPatterns = __esm({
   "packages/shared/dist/secretPatterns.js"() {
     "use strict";
+    SECRET_LABEL = String.raw`[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
+    SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, "i");
+    LABELED_VALUE_RE = new RegExp(String.raw`(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, "gi");
   }
 });
 
@@ -2722,9 +2726,6 @@ var MCP_INSTRUCTIONS = getMcpInstructions();
 
 // packages/shared/dist/codeScanner.js
 var import_ignore = __toESM(require_ignore(), 1);
-init_secretPatterns();
-init_protectedPaths();
-init_projectIdentityFile();
 
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
@@ -6777,7 +6778,269 @@ var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm")
 // packages/shared/dist/ast/astChunker.js
 var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
 
+// packages/shared/dist/redactCredentials.js
+var REDACTED = "<redacted credential>";
+var MAX_PEM_BODY_LENGTH = 8 * 1024;
+var LETTER_OR_DIGIT = /[A-Za-z0-9]/;
+function hasLetterOrDigit(value) {
+  return LETTER_OR_DIGIT.test(value);
+}
+function redactContextValue(match, head = "", value = "") {
+  return hasLetterOrDigit(value) ? `${head}${REDACTED}` : match;
+}
+var PLACEHOLDER_PASSWORD = /^(?:\[REDACTED(?::[A-Za-z0-9_-]+)?\]|redacted|<[^<>]*>|\{\{[^{}]*\}\}|\$\{[^{}]+\}|%[A-Za-z_][A-Za-z0-9_]*%|\*+|x{3,}|\.\.\.|\u2026|password|passwd|pass|pwd|pw|secret|changeme|change[_-]me|example|test|(?:your|my)[a-z_-]*?(?:password|passwd|pass|pwd|secret|key|token|here))$/i;
+var PLACEHOLDER_ENV_VAR = /^\$[A-Z_][A-Z0-9_]*$/;
+function isPlaceholderPassword(password) {
+  return PLACEHOLDER_PASSWORD.test(password) || PLACEHOLDER_ENV_VAR.test(password);
+}
+function redactUrlPassword(match, head = "", password = "") {
+  return isPlaceholderPassword(password) || !hasLetterOrDigit(password) ? match : `${head}${REDACTED}@`;
+}
+var SHELL_WORD = String.raw`'[^'\n]*'|"[^"\n]*"|(?!${REDACTED})[^\s'"\`;|&()[\]{}\\,/][^\s'"\`;|&]*`;
+var OPENING_QUOTE = String.raw`(["'\`]?)`;
+var TRAILING_PUNCTUATION = /[.,:;!?)\]}]+$/;
+var PROSE_WORDS = /* @__PURE__ */ new Set([
+  "a",
+  "an",
+  "and",
+  "as",
+  "for",
+  "in",
+  "is",
+  "it",
+  "on",
+  "or",
+  "the",
+  "to",
+  "with",
+  "flag",
+  "option",
+  "argument",
+  "instead",
+  "which",
+  "that",
+  "this",
+  "puts",
+  "passes",
+  "leaks",
+  "exposes"
+]);
+var REGEX_DELIMITER = /\/(?:[{}()[\];]|$)/;
+function shellWordSecret(word) {
+  const quote = word[0];
+  if ((quote === "'" || quote === '"') && word.length >= 2 && word.endsWith(quote)) {
+    const inner = word.slice(1, -1);
+    if (!hasLetterOrDigit(inner) || quote === '"' && inner.startsWith("$"))
+      return null;
+    if (inner !== inner.trim())
+      return null;
+    return isPlaceholderPassword(inner) ? null : inner;
+  }
+  if (word.startsWith("$"))
+    return null;
+  const core = word.replace(TRAILING_PUNCTUATION, "");
+  if (!hasLetterOrDigit(core) || isPlaceholderPassword(core))
+    return null;
+  if (REGEX_DELIMITER.test(core))
+    return null;
+  return PROSE_WORDS.has(core.toLowerCase()) ? null : core;
+}
+function redactShellWord(match, head = "", word = "", tail = "") {
+  return shellWordSecret(word) === null ? match : `${head}${REDACTED}${tail}`;
+}
+function redactQuotedShellWord(match, head = "", openingQuote = "", word = "", tail = "") {
+  if (openingQuote !== "" && word.startsWith(openingQuote))
+    return match;
+  return redactShellWord(match, head, word, tail);
+}
+var SSHPASS_COMMAND = String.raw`ssh|scp|sftp|rsync|ssh-copy-id|ansible[\w-]*`;
+function redactSshpassWord(match, head = "", openingQuote = "", word = "", tail = "", command = "") {
+  if (openingQuote !== "" && word.startsWith(openingQuote))
+    return match;
+  const secret = shellWordSecret(word);
+  if (secret === null)
+    return match;
+  const bare = word[0] !== "'" && word[0] !== '"';
+  if (bare && /^[a-z]+$/.test(secret) && command === "")
+    return match;
+  return `${head}${REDACTED}${tail}`;
+}
+var PATTERNS = [
+  {
+    kind: "bearer",
+    pattern: /(\bBearer\s+)([^\s]{40,})/gi,
+    replacement: redactContextValue,
+    secretGroup: 2
+  },
+  {
+    // Before openai, whose sk- shape would otherwise claim these keys.
+    kind: "anthropic",
+    pattern: /(?<![A-Za-z0-9_-])sk-ant-(?=[_-]*[A-Za-z0-9])[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "openai",
+    pattern: /(?<![A-Za-z0-9_-])sk-(?:proj-)?(?=[_-]*[A-Za-z0-9])[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "shopify",
+    pattern: /(?<![A-Za-z0-9_])shp(?:at|ss|ca)_[A-Za-z0-9]{16,}(?![A-Za-z0-9])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "aws_access_key",
+    pattern: /(?<![A-Z0-9])AKIA[A-Z0-9]{16}(?![A-Z0-9])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "github",
+    pattern: /(?<![A-Za-z0-9_])gh[opu]_[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "slack",
+    pattern: /(?<![A-Za-z0-9-])xox[abp]-(?=-*[A-Za-z0-9])[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "sentry",
+    pattern: /(?<![A-Za-z0-9_])sntry[us]_(?=[_-]*[A-Za-z0-9])[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "fly",
+    pattern: /(?<![A-Za-z0-9_])(?:FlyV1\s+)?fm2_(?=[_-]*[A-Za-z0-9])[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "google_api_key",
+    pattern: /(?<![A-Za-z0-9_-])AIza(?=[_-]*[A-Za-z0-9])[0-9A-Za-z_-]{35}(?![A-Za-z0-9_-])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "jwt",
+    // header.payload.signature, both JSON segments starting eyJ. The length
+    // floors keep `eyJ...` prose and signature-less examples out.
+    pattern: /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "mnemonik_component_token",
+    // mnc_ / mncr_ + 43 base64url (oauth/components.ts); 32+ also catches a
+    // partial token. The body must contain an upper-case letter or digit, so a
+    // snake_case identifier is not mistaken for one; the 8-character
+    // display prefix (mnc_ + 8) is too short.
+    pattern: /(?<![A-Za-z0-9_])mncr?_(?=[A-Za-z0-9_-]*[A-Z0-9])[A-Za-z0-9_-]{32,}/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "stripe",
+    // Secret and restricted keys (sk_/rk_ live|test) and webhook signing secrets.
+    pattern: /(?<![A-Za-z0-9_])(?:(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}|whsec_[A-Za-z0-9]{20,})(?![A-Za-z0-9])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "mnemonik_proxy_token",
+    // pxt_ + 32 hex (the format server.ts validates). A bare prefix in prose is left.
+    pattern: /(?<![A-Za-z0-9_])pxt_[0-9a-f]{32,}/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "mnemonik_api_key",
+    // mnk_ + 64 hex (AuthManager.generateApiKey); 32+ also catches a half key.
+    // The stored 12-character key_prefix (mnk_ + 8 hex) is not a credential.
+    pattern: /(?<![A-Za-z0-9_])mnk_[0-9a-f]{32,}/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "mnemonik_api_key_legacy",
+    // mnk_ + 43 base64url: keys minted by hand before AuthManager's hex form
+    // (production's only key in 2026-10 has this shape, and one stored memory
+    // held a development key in it). Authentication accepts any mnk_ bearer.
+    // The body needs upper and lower case and a digit, so a snake_case
+    // identifier that starts mnk_ is not taken for one.
+    pattern: /(?<![A-Za-z0-9_])mnk_(?=[A-Za-z0-9_-]*[A-Z])(?=[A-Za-z0-9_-]*[a-z])(?=[A-Za-z0-9_-]*[0-9])[A-Za-z0-9_-]{40,}(?![A-Za-z0-9_-])/g,
+    replacement: REDACTED
+  },
+  {
+    kind: "named_value",
+    pattern: /(\b[A-Za-z_][A-Za-z0-9_]*(?:_TOKEN|_KEY|_SECRET|_PASSWORD|_PASS|APIKEY|API_KEY)\s*(?:=|:)\s*)([^\s]{16,})/gi,
+    replacement: redactContextValue,
+    secretGroup: 2
+  },
+  {
+    kind: "connection_string",
+    // scheme://user:password@host: only the password is replaced; scheme,
+    // user, host and database stay readable. The user may be empty
+    // (redis://:password@host). The password runs to the last `@` before a
+    // path, query, fragment, quote or whitespace, so an unencoded `@` inside
+    // it is still covered. Runs after named_value, which already replaces a
+    // whole URL assigned to a secret-named variable.
+    pattern: /\b((?:postgres(?:ql)?|mysql|mariadb|mongodb|rediss?|amqps?|mssql|sqlserver)(?:\+[a-z0-9]+)?:\/\/[^\s:/?#@'"`<>]{0,256}:)([^\s/?#'"`]{1,512})@/gi,
+    replacement: redactUrlPassword,
+    secretGroup: 2
+  },
+  {
+    kind: "url_basic_auth",
+    // https://user:password@host: same shape and placeholder rules as a
+    // connection string; only the password is replaced.
+    pattern: /\b(https?:\/\/[^\s:/?#@'"`<>]{0,256}:)([^\s/?#'"`]{1,512})@/gi,
+    replacement: redactUrlPassword,
+    secretGroup: 2
+  },
+  // Command-line passwords. Each keeps the command and replaces only the
+  // password word; an expansion or placeholder in that position is left.
+  {
+    // sshpass -p <password> (also -p'<password>' and -p"<password>"), after
+    // any other sshpass flags. 13 memories, 11 scanner chunks, 15 versions and
+    // 6 dated facts in production held one on 2026-10-12.
+    kind: "sshpass_password",
+    pattern: new RegExp(String.raw`(${OPENING_QUOTE}\bsshpass(?:[ \t]+-[a-oq-zA-Z]\S*)*[ \t]+-p[ \t]*)(${SHELL_WORD})()(?=((?:[ \t]+(?:${SSHPASS_COMMAND})(?![\w-]))?))`, "g"),
+    replacement: redactSshpassWord,
+    secretGroup: 3,
+    commandLine: true
+  },
+  {
+    // Environment variables whose only purpose is a password, in shell
+    // assignment form (no space around `=`): libpq's PGPASSWORD (one memory,
+    // version and fact in production), MySQL's MYSQL_PWD, sshpass -e's
+    // SSHPASS. named_value needs an `_PASSWORD`-style suffix and 16
+    // characters, so it misses all three. Not an awk program that matches or
+    // prints the assignment: `/^PGPASSWORD=/ { print "PGPASSWORD=" pw }`.
+    kind: "password_env_var",
+    pattern: new RegExp(String.raw`(${OPENING_QUOTE}\b(?:PGPASSWORD|MYSQL_PWD|SSHPASS)=)(${SHELL_WORD})()`, "g"),
+    replacement: redactQuotedShellWord,
+    secretGroup: 3,
+    commandLine: true
+  },
+  {
+    // --password=<value>, the long option every CLI that takes one spells
+    // this way. The `=` keeps prose about the option ("--password is
+    // required") out; the spaced form is not matched for that reason.
+    kind: "password_option",
+    pattern: new RegExp(String.raw`(${OPENING_QUOTE}(?<![\w-])--password=)(${SHELL_WORD})()`, "g"),
+    replacement: redactQuotedShellWord,
+    secretGroup: 3,
+    commandLine: true
+  },
+  {
+    // echo <password> | sudo -S: sudo reads the password from stdin. One
+    // memory, two versions and two facts in production.
+    kind: "sudo_password",
+    pattern: new RegExp(String.raw`(\becho[ \t]+(?:-[neE]+[ \t]+)?)(${SHELL_WORD})([ \t]*\|[ \t]*sudo\b[^|\n]*?[ \t](?:-[A-Za-z]*S[A-Za-z]*|--stdin)\b)`, "g"),
+    replacement: redactShellWord,
+    secretGroup: 2,
+    commandLine: true
+  }
+];
+
+// packages/shared/dist/sourceRedaction.js
+init_secretPatterns();
+
 // packages/shared/dist/codeScanner.js
+init_protectedPaths();
+init_projectIdentityFile();
 var MAX_SCANNED_FILE_BYTES = 10 * 1024 * 1024;
 var BUILT_IN_IGNORE_DIRS = [
   // JS / web

package/dist/sbom.json

@@ -17,13 +17,13 @@
       }
     ],
     "component": {
-      "bom-ref": "@mnemonik/cli@0.1.154",
+      "bom-ref": "@mnemonik/cli@0.1.156",
       "type": "library",
       "name": "@mnemonik/cli",
-      "version": "0.1.154",
+      "version": "0.1.156",
       "scope": "required",
       "description": "Mnemonik installer and local project helper",
-      "purl": "pkg:npm/%40mnemonik/cli@0.1.154",
+      "purl": "pkg:npm/%40mnemonik/cli@0.1.156",
       "properties": [],
       "externalReferences": [
         {
@@ -35,12 +35,12 @@
   },
   "components": [
     {
-      "bom-ref": "@mnemonik/credentials@0.1.154",
+      "bom-ref": "@mnemonik/credentials@0.1.156",
       "type": "library",
       "name": "@mnemonik/credentials",
-      "version": "0.1.154",
+      "version": "0.1.156",
       "scope": "required",
-      "purl": "pkg:npm/%40mnemonik/credentials@0.1.154",
+      "purl": "pkg:npm/%40mnemonik/credentials@0.1.156",
       "properties": [],
       "externalReferences": [
         {
@@ -50,12 +50,12 @@
       ]
     },
     {
-      "bom-ref": "@mnemonik/local-setup@0.1.154",
+      "bom-ref": "@mnemonik/local-setup@0.1.156",
       "type": "library",
       "name": "@mnemonik/local-setup",
-      "version": "0.1.154",
+      "version": "0.1.156",
       "scope": "required",
-      "purl": "pkg:npm/%40mnemonik/local-setup@0.1.154",
+      "purl": "pkg:npm/%40mnemonik/local-setup@0.1.156",
       "properties": [],
       "externalReferences": [
         {
@@ -65,14 +65,14 @@
       ]
     },
     {
-      "bom-ref": "@mnemonik/shared@7.141.0",
+      "bom-ref": "@mnemonik/shared@7.141.2",
       "type": "library",
       "name": "@mnemonik/shared",
-      "version": "7.141.0",
+      "version": "7.141.2",
       "scope": "required",
       "author": "Anthony",
       "description": "Shared constants and utilities for Mnemonik packages",
-      "purl": "pkg:npm/%40mnemonik/shared@7.141.0",
+      "purl": "pkg:npm/%40mnemonik/shared@7.141.2",
       "properties": [],
       "externalReferences": [
         {
@@ -271,29 +271,29 @@
   ],
   "dependencies": [
     {
-      "ref": "@mnemonik/cli@0.1.154",
+      "ref": "@mnemonik/cli@0.1.156",
       "dependsOn": [
-        "@mnemonik/credentials@0.1.154",
-        "@mnemonik/local-setup@0.1.154",
-        "@mnemonik/shared@7.141.0",
+        "@mnemonik/credentials@0.1.156",
+        "@mnemonik/local-setup@0.1.156",
+        "@mnemonik/shared@7.141.2",
         "smol-toml@1.9.0"
       ]
     },
     {
-      "ref": "@mnemonik/credentials@0.1.154",
+      "ref": "@mnemonik/credentials@0.1.156",
       "dependsOn": [
-        "@mnemonik/local-setup@0.1.154"
+        "@mnemonik/local-setup@0.1.156"
       ]
     },
     {
-      "ref": "@mnemonik/local-setup@0.1.154",
+      "ref": "@mnemonik/local-setup@0.1.156",
       "dependsOn": [
-        "@mnemonik/shared@7.141.0",
+        "@mnemonik/shared@7.141.2",
         "proper-lockfile@4.1.2"
       ]
     },
     {
-      "ref": "@mnemonik/shared@7.141.0",
+      "ref": "@mnemonik/shared@7.141.2",
       "dependsOn": [
         "ignore@7.0.12",
         "web-tree-sitter@0.27.0"