@openclaw/lobster 2026.6.33 → 2026.6.35

package/node_modules/fast-uri/.github/dependabot.yml

@@ -2,12 +2,52 @@ version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
     schedule:
-      interval: "monthly"
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
     open-pull-requests-limit: 10
 
   - package-ecosystem: "npm"
     directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
     schedule:
-      interval: "monthly"
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    versioning-strategy: "increase-if-necessary"
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+    ignore:
+      # TODO: remove ignore until neostandard support ESLint 10
+      - dependency-name: "eslint"
+      - dependency-name: "neostandard"
+      - dependency-name: "@stylistic/*"
     open-pull-requests-limit: 10
+    groups:
+      # Production dependencies with breaking changes
+      dependencies:
+        dependency-type: "production"
+      # ESLint related dependencies
+      dev-dependencies-eslint:
+        patterns:
+          - "eslint"
+          - "neostandard"
+          - "@stylistic/*"
+      # TypeScript related dependencies
+      dev-dependencies-typescript:
+        patterns:
+          - "@types/*"
+          - "tstyche"
+          - "typescript"

package/node_modules/fast-uri/.github/workflows/ci.yml

@@ -23,17 +23,65 @@ permissions:
   contents: read
 
 jobs:
+  type-tests:
+    name: Type Tests
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: ['20', '22', '24', '26']
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+          cache-dependency-path: package.json
+          check-latest: true
+
+      - name: Install dependencies
+        run: npm install --ignore-scripts
+
+      - name: Run type tests
+        run: npm run test:typescript
+
+  unit-tests:
+    name: Unit Tests
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: ['16', '18', '20', '22', '24', '26']
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+          cache-dependency-path: package.json
+          check-latest: true
+
+      - name: Install dependencies
+        run: npm install --ignore-scripts
+
+      - name: Run unit tests
+        run: npm test
+
   test-regression-check-node10:
     name: Test compatibility with Node.js 10
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '10'
           cache: 'npm'
@@ -71,11 +119,11 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -99,8 +147,8 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v6
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@ef591e2186785d5ab36b9fe6a79c7ce2f1d94e57 # v7.0.0
     with:
       license-check: true
       lint: true
-      node-versions: '["16", "18", "20", "22", "24"]'
+      node-versions: '["16", "18", "20", "22", "24", "26"]'

package/node_modules/fast-uri/.github/workflows/lock-threads.yml

@@ -16,4 +16,4 @@ jobs:
     permissions:
       issues: write
       pull-requests: write
-    uses: fastify/workflows/.github/workflows/lock-threads.yml@v6
+    uses: fastify/workflows/.github/workflows/lock-threads.yml@ef591e2186785d5ab36b9fe6a79c7ce2f1d94e57 # v7.0.0

package/node_modules/fast-uri/.github/workflows/ossf-scorecard.yml

@@ -0,0 +1,45 @@
+name: OSSF Scorecard Analysis
+
+# **What it does**: Runs OSSF Scorecard analysis on the repository and uploads the results.
+# **Why we have it**: Security scanning.
+
+on:
+    branch_protection_rule:
+    push:
+        branches:
+            - main
+        paths-ignore:
+            - "docs/**"
+            - "*.md"
+    schedule:
+        #        ┌───────────── minute (0 - 59)
+        #        │  ┌───────────── hour (0 - 23)
+        #        │  │ ┌───────────── day of the month (1 - 31)
+        #        │  │ │ ┌───────────── month (1 - 12 or JAN-DEC)
+        #        │  │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT)
+        #        │  │ │ │ │
+        #        │  │ │ │ │
+        #        │  │ │ │ │
+        #        *  * * * *
+        - cron: "21 17 * * 0"
+    # Allows this workflow to be run manually from the Actions tab
+    workflow_dispatch:
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+    group: "${{ github.workflow }}-${{ github.event.pull_request.head.label || github.head_ref || github.ref }}"
+    cancel-in-progress: true
+
+permissions:
+    contents: read
+
+jobs:
+    analysis:
+        name: OSSF Scorecard Analysis
+        permissions:
+            contents: read
+            id-token: write
+            security-events: write
+        uses: fastify/workflows/.github/workflows/reusable-ossf-scorecard.yml@ef591e2186785d5ab36b9fe6a79c7ce2f1d94e57 #v7.0.0
+        with:
+            publish_results: true

package/node_modules/fast-uri/README.md

@@ -3,6 +3,7 @@
 [![NPM version](https://img.shields.io/npm/v/fast-uri.svg?style=flat)](https://www.npmjs.com/package/fast-uri)
 [![CI](https://github.com/fastify/fast-uri/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/fastify/fast-uri/actions/workflows/ci.yml)
 [![neostandard javascript style](https://img.shields.io/badge/code_style-neostandard-brightgreen?style=flat)](https://github.com/neostandard/neostandard)
+[![OSSF Scorecard](https://api.scorecard.dev/projects/github.com/fastify/fast-uri/badge)](https://scorecard.dev/viewer/?uri=github.com/fastify/fast-uri)
 
 Dependency-free RFC 3986 URI toolbox.
 
@@ -27,10 +28,10 @@ Malformed authorities and out-of-range ports are reported through the parsed com
 	If set to `true`, the serializer will not resolve a relative `path` component.
 
 *	`unicodeSupport` (boolean, false)
-	If set to `true`, the parser will unescape non-ASCII characters in the parsed output as per [RFC 3987](http://www.ietf.org/rfc/rfc3987.txt).
+	If set to `true`, the parser will unescape non-ASCII characters in the parsed output as per [RFC 3987](https://www.ietf.org/rfc/rfc3987.txt).
 
 *	`domainHost` (boolean, false)
-	If set to `true`, the library will treat the `host` component as a domain name, and convert IDNs (International Domain Names) as per [RFC 5891](http://www.ietf.org/rfc/rfc5891.txt).
+	If set to `true`, the library will treat the `host` component as a domain name, and convert IDNs (International Domain Names) as per [RFC 5891](https://www.ietf.org/rfc/rfc5891.txt).
 
 ### Parse
 
@@ -90,14 +91,14 @@ true
 
 ## Scheme supports
 
-fast-uri supports inserting custom [scheme](http://en.wikipedia.org/wiki/URI_scheme)-dependent processing rules. Currently, fast-uri has built-in support for the following schemes:
+fast-uri supports inserting custom [scheme](https://en.wikipedia.org/wiki/URI_scheme)-dependent processing rules. Currently, fast-uri has built-in support for the following schemes:
 
-*	http \[[RFC 2616](http://www.ietf.org/rfc/rfc2616.txt)\]
-*	https \[[RFC 2818](http://www.ietf.org/rfc/rfc2818.txt)\]
-*	ws \[[RFC 6455](http://www.ietf.org/rfc/rfc6455.txt)\]
-*	wss \[[RFC 6455](http://www.ietf.org/rfc/rfc6455.txt)\]
-*	urn \[[RFC 2141](http://www.ietf.org/rfc/rfc2141.txt)\]
-*	urn:uuid \[[RFC 4122](http://www.ietf.org/rfc/rfc4122.txt)\]
+*	http \[[RFC 2616](https://www.ietf.org/rfc/rfc2616.txt)\]
+*	https \[[RFC 2818](https://www.ietf.org/rfc/rfc2818.txt)\]
+*	ws \[[RFC 6455](https://www.ietf.org/rfc/rfc6455.txt)\]
+*	wss \[[RFC 6455](https://www.ietf.org/rfc/rfc6455.txt)\]
+*	urn \[[RFC 2141](https://www.ietf.org/rfc/rfc2141.txt)\]
+*	urn:uuid \[[RFC 4122](https://www.ietf.org/rfc/rfc4122.txt)\]
 
 
 ## Benchmarks

package/node_modules/fast-uri/SECURITY.md

@@ -0,0 +1,173 @@
+# Security Policy
+
+This document describes the management of vulnerabilities for `fast-uri`, an
+official Fastify project package. It supplements the Fastify project's
+[organization-wide security policy](https://github.com/fastify/.github/blob/main/SECURITY.md).
+
+## Standards and scope
+
+`fast-uri` implements URI parsing and normalization according to
+[RFC 3986](https://www.rfc-editor.org/rfc/rfc3986). It does not implement the
+[WHATWG URL Standard](https://url.spec.whatwg.org/).
+
+Differences between `fast-uri` and WHATWG URL implementations are expected.
+Reports based solely on comparing or mixing parsers that follow these different
+standards are out of scope. Applications must use the same parsing and
+normalization rules for both security decisions and subsequent URI use.
+
+Reports are assessed based on reproducibility, documented supported usage, and
+concrete security impact—not merely on whether they mention WHATWG URL
+behavior. Reports demonstrating a parsing or normalization flaw in a supported
+scheme remain eligible for evaluation.
+
+## Threat model
+
+`fast-uri`'s threat model extends the
+[Node.js threat model](https://github.com/nodejs/node/blob/main/SECURITY.md#the-nodejs-threat-model).
+
+**Trusted:** Application code, parser options, configuration, and the runtime
+environment.
+
+**Untrusted:** URI and IRI strings passed to the package's public APIs.
+
+### Examples of vulnerabilities
+
+- RFC 3986 parsing or normalization flaws that bypass security controls
+- Denial of service through malformed input
+- Inconsistent parsing or normalization between `fast-uri` APIs
+
+### Examples of non-vulnerabilities
+
+The following are **not** considered vulnerabilities in `fast-uri`:
+
+- **Different URL standards:** Differences between RFC 3986 behavior and
+  WHATWG URL behavior, including differences exposed by mixing parsers that
+  implement those standards
+- **Unsupported scheme semantics:** Scheme-specific behavior for schemes that
+  `fast-uri` does not document as supported
+- **Application code vulnerabilities:** Security flaws in code that consumes
+  `fast-uri` output
+- **Configuration mistakes:** Security issues caused by incorrect parser
+  options or application configuration
+- **Missing security features:** Application-level protections that are not
+  part of URI parsing or normalization
+- **Third-party dependencies:** Vulnerabilities in packages used by an
+  application alongside `fast-uri`
+
+## Reporting vulnerabilities
+
+Individuals who find potential vulnerabilities in `fast-uri` are invited to
+complete a vulnerability report via the
+[GitHub Security page][advisory].
+
+Do not assign or request a CVE directly.
+CVE assignment is handled by the Fastify Security Team.
+Fastify falls under the [OpenJS CNA](https://cna.openjsf.org/).
+A CVE will be assigned as part of our responsible disclosure process.
+
+> [!NOTE]
+> Fastify's [HackerOne](https://hackerone.com/fastify) program is now closed.
+
+[advisory]: ../../security/advisories/new
+
+### Strict measures when reporting vulnerabilities
+
+It is of the utmost importance that you read carefully and follow these
+guidelines to ensure the ecosystem as a whole is not disrupted due to
+improperly reported vulnerabilities:
+
+- Avoid creating new "informative" reports. Only create a new report if you are
+  confident the issue is an actual vulnerability. Third-party vendors and
+  individuals track new GitHub security reports and may flag them for their
+  customers.
+- Security reports should never be created and triaged by the same person. A
+  second Security Team member must triage a report submitted by a team member
+  or on their behalf. If in doubt, invite more Fastify collaborators to help
+  review the report.
+- **Do not** attempt to demonstrate CI/CD vulnerabilities by creating pull
+  requests in Fastify organization repositories. Doing so will result in a
+  [content report][content-report] to GitHub as an unsolicited exploit. Create
+  a separate repository configured like the affected repository and provide
+  the proof of concept there instead.
+
+[content-report]: https://docs.github.com/en/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam#reporting-an-issue-or-pull-request
+
+### Vulnerabilities found outside this process
+
+The Fastify project does not support vulnerability reporting outside the
+process described in this document.
+
+## Handling vulnerability reports
+
+When a potential vulnerability is reported, the following actions are taken.
+
+### Triage
+
+**Delay:** 4 business days
+
+Within 4 business days, a member of the Security Team provides a first response
+to the reporter. The possible responses are:
+
+- **Acceptance:** The report is considered a new vulnerability.
+- **Rejection:** The report is not considered a new vulnerability.
+- **Need more information:** The Security Team needs more information to
+  evaluate the report.
+
+Triaging should include updating these issue fields:
+
+- Asset: set or create the module affected by the report
+- Severity: TBD, initially left empty
+
+### Correction follow-up
+
+**Delay:** 90 days
+
+When a vulnerability is confirmed, a member of the Security Team volunteers to
+follow up on the report.
+
+With the reporter's help, they contact the maintainers of the vulnerable
+package and may invite them as participants in the report. Together, they
+define a publication date. Ideally, publication should not happen before the
+package has been patched.
+
+The report's vulnerable-version upper limit should be set to:
+
+- `*` if no fixed version is available when the report is published
+- the last vulnerable version, such as `<=1.2.3`, if the fix is released in
+  `1.2.4`
+
+### Publication
+
+**Delay:** 90 days
+
+Within 90 days after triage, the vulnerability must be made public.
+
+Vulnerability severity is assessed using
+[CVSS v3](https://www.first.org/cvss/user-guide).
+
+If package maintainers are actively developing a patch, the Security Team and
+the reporter may approve an additional delay.
+
+### Secondary contact
+
+If you do not receive an acknowledgment within 6 business days, or cannot find
+a private security contact, contact the OpenJS Foundation CNA at
+<https://cna.openjsf.org/> or `security@lists.openjsf.org` for assistance.
+
+The CNA can help ensure that reports are acknowledged, coordinate disclosure
+timelines, and assign CVEs when necessary.
+
+## The Fastify Security Team
+
+The core team manages the security program, policy, and process.
+
+Team members must keep all privileged information private. This includes the
+existence of undisclosed issues, expected release dates, and upcoming patches.
+
+### Members
+
+- [Matteo Collina](https://github.com/mcollina)
+- [Tomas Della Vedova](https://github.com/delvedor)
+- [Vincent Le Goff](https://github.com/zekth)
+- [KaKa Ng](https://github.com/climba03003)
+- [James Sumners](https://github.com/jsumners)

package/node_modules/fast-uri/benchmark/benchmark.mjs

@@ -10,6 +10,21 @@ const ipv6 = '//[2001:db8::7]'
 const urn = 'urn:foo:a123,456'
 const urnuuid = 'urn:uuid:f81d4fae-7dec-11d0-a765-00a0c91e6bf6'
 
+const mailtoSimple = 'mailto:chris@example.com'
+const mailtoWithSubject = 'mailto:infobot@example.com?subject=current-issue'
+const mailtoWithBody = 'mailto:infobot@example.com?body=send%20current-issue%0D%0Asend%20index'
+const mailtoWithHeaders = 'mailto:list@example.org?In-Reply-To=%3C3469A91.D10AF4C@example.com%3E'
+const mailtoMultiple = 'mailto:joe@example.com,alice@example.org?subject=Test&body=NATTO'
+const mailtoEncoded = 'mailto:%22oh%5C%5Cno%22@example.org'
+
+const mailtoComponent = {
+  scheme: 'mailto',
+  to: ['chris@example.com'],
+  subject: 'current-issue',
+  body: 'send current-issue\r\nsend index',
+  headers: { 'In-Reply-To': '<3469A91.D10AF4C@example.com>' }
+}
+
 const urnuuidComponent = {
   scheme: 'urn',
   nid: 'uuid',
@@ -146,6 +161,62 @@ benchUriJs.add('urijs: equal', function () {
   uriJsEqual('example://a/b/c/%7Bfoo%7D', 'eXAMPLE://a/./b/../b/%63/%7bfoo%7d')
 })
 
+benchFastUri.add('fast-uri: parse mailto simple', function () {
+  fastUriParse(mailtoSimple)
+})
+benchUriJs.add('urijs: parse mailto simple', function () {
+  uriJsParse(mailtoSimple)
+})
+
+benchFastUri.add('fast-uri: parse mailto subject', function () {
+  fastUriParse(mailtoWithSubject)
+})
+benchUriJs.add('urijs: parse mailto subject', function () {
+  uriJsParse(mailtoWithSubject)
+})
+
+benchFastUri.add('fast-uri: parse mailto body CRLF', function () {
+  fastUriParse(mailtoWithBody)
+})
+benchUriJs.add('urijs: parse mailto body CRLF', function () {
+  uriJsParse(mailtoWithBody)
+})
+
+benchFastUri.add('fast-uri: parse mailto headers', function () {
+  fastUriParse(mailtoWithHeaders)
+})
+benchUriJs.add('urijs: parse mailto headers', function () {
+  uriJsParse(mailtoWithHeaders)
+})
+
+benchFastUri.add('fast-uri: parse mailto multi recipient', function () {
+  fastUriParse(mailtoMultiple)
+})
+benchUriJs.add('urijs: parse mailto multi recipient', function () {
+  uriJsParse(mailtoMultiple)
+})
+
+benchFastUri.add('fast-uri: parse mailto encoded local', function () {
+  fastUriParse(mailtoEncoded)
+})
+benchUriJs.add('urijs: parse mailto encoded local', function () {
+  uriJsParse(mailtoEncoded)
+})
+
+benchFastUri.add('fast-uri: serialize mailto', function () {
+  fastUriSerialize(mailtoComponent)
+})
+benchUriJs.add('urijs: serialize mailto', function () {
+  uriJsSerialize(mailtoComponent)
+})
+
+benchFastUri.add('fast-uri: serialize+parse mailto round-trip', function () {
+  fastUriSerialize(fastUriParse(mailtoWithBody))
+})
+benchUriJs.add('urijs: serialize+parse mailto round-trip', function () {
+  uriJsSerialize(uriJsParse(mailtoWithBody))
+})
+
 await benchFastUri.run()
 console.log(benchFastUri.name)
 console.table(benchFastUri.table())

package/node_modules/fast-uri/benchmark/encoder.mjs

@@ -0,0 +1,54 @@
+import { Bench } from 'tinybench'
+import { fastUri } from '../index.js'
+
+const { serialize, normalize, parse } = fastUri
+
+const asciiPath = '/users/profile/settings/account'
+const asciiPathWithSpaces = '/users/john doe/profile page'
+const cjkPath = '/ユーザー/プロフィール/設定'
+const mixedPath = '/users/日本/profile-📱-emoji/設定'
+const emojiPath = '/🚀/🌍/🎉/end'
+const longAsciiPath = '/' + 'a/b/c/d/e/f/g/h/'.repeat(20)
+const longUtf8Path = '/' + '日本/中文/한국/'.repeat(20)
+
+const bench = new Bench({ name: 'encoder bench', time: 1000 })
+
+bench.add('serialize ascii path', () => {
+  serialize({ scheme: 'http', host: 'example.com', path: asciiPath })
+})
+
+bench.add('serialize ascii path with spaces', () => {
+  serialize({ scheme: 'http', host: 'example.com', path: asciiPathWithSpaces })
+})
+
+bench.add('serialize cjk path', () => {
+  serialize({ scheme: 'http', host: 'example.com', path: cjkPath })
+})
+
+bench.add('serialize mixed path', () => {
+  serialize({ scheme: 'http', host: 'example.com', path: mixedPath })
+})
+
+bench.add('serialize emoji path', () => {
+  serialize({ scheme: 'http', host: 'example.com', path: emojiPath })
+})
+
+bench.add('serialize long ascii path', () => {
+  serialize({ scheme: 'http', host: 'example.com', path: longAsciiPath })
+})
+
+bench.add('serialize long utf8 path', () => {
+  serialize({ scheme: 'http', host: 'example.com', path: longUtf8Path })
+})
+
+bench.add('normalize utf8 uri', () => {
+  normalize('http://example.com/日本/profile')
+})
+
+bench.add('parse utf8 uri', () => {
+  parse('http://example.com/日本/profile')
+})
+
+await bench.run()
+console.log(bench.name)
+console.table(bench.table())