@zuplo/cli 6.71.15 → 6.71.17

package/node_modules/qs/test/parse.js

@@ -14,6 +14,12 @@ var hasProto = require('has-proto')();
 var qs = require('../');
 var utils = require('../lib/utils');
 
+var characterizeParse = function characterizeParse(st, input, opts, expected, label) {
+    var result;
+    st.doesNotThrow(function () { result = qs.parse(input, opts); }, label + ': does not throw');
+    st.deepEqual(result, expected, label + ': parses to the current lenient output');
+};
+
 test('parse()', function (t) {
     t.test('parses a simple string', function (st) {
         st.deepEqual(qs.parse('0=foo'), { 0: 'foo' });
@@ -312,6 +318,48 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('currently parses unbalanced bracket keys after a parent leniently to literal segments (issue #558)', function (st) {
+        characterizeParse(st, 'a[bc=v', undefined, { a: { '[bc': 'v' } }, 'unclosed group after a parent');
+        characterizeParse(st, 'a[=v', undefined, { a: { '[': 'v' } }, 'bare unclosed bracket after a parent');
+        characterizeParse(st, 'a[b][c=v', undefined, { a: { b: { '[c': 'v' } } }, 'unclosed group after a valid one');
+        characterizeParse(st, 'a[b]c[d=v', undefined, { a: { b: { '[d': 'v' } } }, 'unclosed group after text following a valid one');
+        characterizeParse(st, 'filters[customtags:Env: Prod=v', undefined, { filters: { '[customtags:Env: Prod': 'v' } }, 'the issue #558 reproduction');
+        characterizeParse(st, '][a=v', undefined, { ']': { '[a': 'v' } }, 'stray close bracket before an unclosed group');
+        characterizeParse(st, 'a][b=v', undefined, { 'a]': { '[b': 'v' } }, 'stray close bracket inside the parent');
+        st.end();
+    });
+
+    t.test('currently parses unbalanced bracket keys containing inner brackets leniently (issue #558)', function (st) {
+        characterizeParse(st, 'a[b[c=v', undefined, { a: { '[b[c': 'v' } }, 'unclosed group containing an inner bracket');
+        characterizeParse(st, 'a[b[c]=v', undefined, { a: { '[b[c]': 'v' } }, 'unbalanced group with an inner bracket and one close');
+        characterizeParse(st, 'a[b][c[d=v', undefined, { a: { b: { '[c[d': 'v' } } }, 'unclosed inner-bracket group after a valid one');
+        st.end();
+    });
+
+    t.test('currently parses bracket-prefixed unbalanced keys leniently (issue #558)', function (st) {
+        characterizeParse(st, '[abc=v', undefined, { '[abc': 'v' }, 'key starting with an unclosed bracket');
+        characterizeParse(st, '[[]b=v', undefined, { '[[]b': 'v' }, 'key starting with an unbalanced bracket group');
+        st.end();
+    });
+
+    t.test('lenient unbalanced-bracket handling currently depends on the depth option (issue #558)', function (st) {
+        characterizeParse(st, 'a[b]c[d]e[f=v', { depth: 5 }, { a: { b: { d: { '[f': 'v' } } } }, 'consumes groups up to the depth budget then keeps the unclosed remainder literal');
+        characterizeParse(st, 'a[b]c[d]e[f=v', { depth: 1 }, { a: { b: { '[d]e[f': 'v' } } }, 'a lower depth keeps more of the unclosed remainder literal');
+        characterizeParse(st, 'a[bc=v', { depth: 0 }, { 'a[bc': 'v' }, 'depth 0 keeps the entire key literal');
+        st.end();
+    });
+
+    t.test('currently parses an allowDots key with a trailing unclosed bracket leniently (issue #558)', function (st) {
+        characterizeParse(st, 'a.b[c=v', { allowDots: true }, { a: { b: { '[c': 'v' } } }, 'allowDots expands the dot then keeps the unclosed bracket literal');
+        st.end();
+    });
+
+    t.test('valid and stray-close bracket keys are unaffected by unbalanced-bracket handling', function (st) {
+        characterizeParse(st, 'a]b=v', undefined, { 'a]b': 'v' }, 'stray close bracket with no open bracket stays a flat key');
+        characterizeParse(st, 'a[b]extra=v', undefined, { a: { b: 'v' } }, 'text after a balanced group is ignored');
+        st.end();
+    });
+
     t.test('allows to specify array indices', function (st) {
         st.deepEqual(qs.parse('a[1]=c&a[0]=b&a[2]=d'), { a: ['b', 'c', 'd'] });
         st.deepEqual(qs.parse('a[1]=c&a[0]=b'), { a: ['b', 'c'] });
@@ -726,6 +774,21 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('does not crash on multi-step circular references', function (st) {
+        var a = {};
+        a.b = { c: { d: a } };
+
+        var parsed;
+
+        st.doesNotThrow(function () {
+            parsed = qs.parse({ foo: a });
+        });
+
+        st.equal('foo' in parsed, true, 'parsed has "foo" property');
+        st.equal(parsed.foo.b.c.d, parsed.foo, 'the multi-step cycle is preserved');
+        st.end();
+    });
+
     t.test('does not crash when parsing deep objects', function (st) {
         var parsed;
         var str = 'foo';
@@ -959,6 +1022,22 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('object-valued input with own `__proto__` does not mutate sub-object [[Prototype]]', function (st) {
+        // JSON.parse creates own data `__proto__` properties (via CreateDataProperty),
+        // which would trigger the Object.prototype.__proto__ accessor if merged via `acc[key] = value`.
+        var out = qs.parse({
+            'user[name]': 'alice',
+            user: JSON.parse('{"__proto__":{"isAdmin":true}}')
+        }, { allowPrototypes: false });
+
+        st.equal(out.user.name, 'alice', 'name from bracket key is preserved');
+        st.equal(out.user.isAdmin, undefined, 'attacker-controlled inherited property is not exposed');
+        st.equal(Object.getPrototypeOf(out.user), Object.prototype, 'sub-object [[Prototype]] is unchanged');
+        st.equal(Object.prototype.isAdmin, undefined, 'Object.prototype is not polluted');
+
+        st.end();
+    });
+
     t.test('can return null objects', { skip: !hasProto }, function (st) {
         var expected = {
             __proto__: null,
@@ -1309,6 +1388,157 @@ test('parse()', function (t) {
             sst.end();
         });
 
+        st.test('throws when cumulative comma + duplicate-key combine exceeds arrayLimit', function (sst) {
+            sst['throws'](
+                function () {
+                    qs.parse('a=1,2,3&a=4,5,6', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
+                },
+                new RangeError('Array limit exceeded. Only 5 elements allowed in an array.'),
+                'throws when comma groups within the limit cumulatively exceed it across duplicate keys'
+            );
+
+            sst['throws'](
+                function () {
+                    qs.parse('a=v,v,v,v,v&a=v,v,v,v,v&a=v,v,v,v,v', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
+                },
+                new RangeError('Array limit exceeded. Only 5 elements allowed in an array.'),
+                'throws on a subsequent part once the cumulative array is already over the limit'
+            );
+            sst.end();
+        });
+
+        st.test('throws when plain duplicate keys combine past arrayLimit at the boundary', function (sst) {
+            sst['throws'](
+                function () { qs.parse('a=x&a=y', { arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'duplicate scalar keys'
+            );
+
+            sst['throws'](
+                function () { qs.parse('a[]=x&a[]=y', { arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'duplicate bracket keys'
+            );
+            sst.end();
+        });
+
+        st.test('throws when mixed index and key notation merge past arrayLimit', function (sst) {
+            sst['throws'](
+                function () { qs.parse('a=x&a[0]=y', { arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'scalar then index that overflows on merge'
+            );
+
+            sst['throws'](
+                function () { qs.parse('a[0]=1&a[1]=2&a=3', { arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'indexed array then scalar that overflows on merge'
+            );
+            sst.end();
+        });
+
+        st.test('enforces arrayLimit on merge at the boundary, consistently with combine', function (sst) {
+            sst['throws'](
+                function () { qs.parse('a[0]=x&a=y', { arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'a trailing scalar merged into an at-limit array throws'
+            );
+            sst.deepEqual(
+                qs.parse('a[0]=x&a=y', { arrayLimit: 1 }),
+                { a: { 0: 'x', 1: 'y' } },
+                'and converts to an overflow object without throwOnLimitExceeded'
+            );
+
+            sst['throws'](
+                function () { qs.parse('a[0]=x&a[]=y', { arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'mixed index and bracket notation merged past the limit throws'
+            );
+            sst.deepEqual(
+                qs.parse('a[0]=x&a[]=y', { arrayLimit: 1 }),
+                { a: { 0: 'x', 1: 'y' } },
+                'mixed index and bracket notation converts like duplicate-bracket combine'
+            );
+
+            sst.end();
+        });
+
+        st.test('does not throw when cumulative comma combine stays within arrayLimit', function (sst) {
+            var result = qs.parse('a=1,2,3&a=4', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
+            sst.deepEqual(result, { a: ['1', '2', '3', '4'] }, 'combined array within limit is preserved');
+            sst.end();
+        });
+
+        st.test('silently combines to an overflow object when throwOnLimitExceeded is not set', function (sst) {
+            var result = qs.parse('a=1,2,3&a=4,5,6', { comma: true, arrayLimit: 5 });
+            sst.deepEqual(result, { a: { 0: '1', 1: '2', 2: '3', 3: '4', 4: '5', 5: '6' } }, 'converts to object without throwing');
+            sst.end();
+        });
+
+        st.test('does not throw for comma groups nested under bracket notation, counting each group as one element', function (sst) {
+            var result = qs.parse('a[]=1,2,3&a[]=4,5,6', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
+            sst.deepEqual(result, { a: [['1', '2', '3'], ['4', '5', '6']] }, 'nested comma groups count as one element each');
+            sst.end();
+        });
+
+        st.test('throws before splitting when a single comma value exceeds arrayLimit', function (sst) {
+            sst['throws'](
+                function () {
+                    qs.parse('a=1,2,3,4,5,6', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
+                },
+                new RangeError('Array limit exceeded. Only 5 elements allowed in an array.'),
+                'a flat comma value over the limit throws'
+            );
+
+            sst['throws'](
+                function () {
+                    qs.parse('a=1,2', { comma: true, arrayLimit: 1, throwOnLimitExceeded: true });
+                },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'singular message at arrayLimit 1'
+            );
+
+            sst['throws'](
+                function () {
+                    qs.parse('a[b]=1,2,3,4,5,6', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
+                },
+                new RangeError('Array limit exceeded. Only 5 elements allowed in an array.'),
+                'a non-bracket nested key comma value over the limit throws'
+            );
+            sst.end();
+        });
+
+        st.test('does not throw for a single comma value within arrayLimit', function (sst) {
+            sst.deepEqual(
+                qs.parse('a=1,2,3', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true }),
+                { a: ['1', '2', '3'] },
+                'within the limit'
+            );
+            sst.deepEqual(
+                qs.parse('a=1,2,3,4,5', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true }),
+                { a: ['1', '2', '3', '4', '5'] },
+                'exactly at the limit'
+            );
+            sst.end();
+        });
+
+        st.test('does not throw for a bracketed comma group within arrayLimit', function (sst) {
+            var result = qs.parse('a[]=1,2,3,4,5,6', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
+            sst.deepEqual(result, { a: [['1', '2', '3', '4', '5', '6']] }, 'a bracketed comma group is a single element');
+            sst.end();
+        });
+
+        st.test('throws for a bracketed comma group when arrayLimit is 0', function (sst) {
+            sst['throws'](
+                function () {
+                    qs.parse('a[]=1,2,3', { comma: true, arrayLimit: 0, throwOnLimitExceeded: true });
+                },
+                new RangeError('Array limit exceeded. Only 0 elements allowed in an array.'),
+                'a single bracketed element still exceeds arrayLimit 0'
+            );
+            sst.end();
+        });
+
         st.end();
     });
 

package/node_modules/qs/test/utils.js

@@ -65,6 +65,7 @@ test('merge()', function (t) {
             observed[0] = observed[0]; // eslint-disable-line no-self-assign
             st.equal(setCount, 1);
             st.equal(getCount, 2);
+
             st.end();
         }
     );
@@ -78,6 +79,7 @@ test('merge()', function (t) {
             s2t.ok(utils.isOverflow(overflow), 'overflow object is marked');
             var merged = utils.merge(overflow, 'd');
             s2t.deepEqual(merged, { 0: 'a', 1: 'b', 2: 'c', 3: 'd' }, 'adds primitive at next numeric index');
+
             s2t.end();
         });
 
@@ -93,6 +95,7 @@ test('merge()', function (t) {
             var obj = { foo: 'bar' };
             var merged = utils.merge(obj, 'baz');
             s2t.deepEqual(merged, { foo: 'bar', baz: true }, 'adds primitive as key with value true');
+
             s2t.end();
         });
 
@@ -110,6 +113,7 @@ test('merge()', function (t) {
             var merged = utils.merge('c', overflow);
             s2t.ok(utils.isOverflow(merged), 'result is also marked as overflow');
             s2t.deepEqual(merged, { 0: 'c', 1: 'a', 2: 'b' }, 'creates object with primitive at 0, source values shifted');
+
             s2t.end();
         });
 
@@ -119,6 +123,7 @@ test('merge()', function (t) {
             var merged = utils.merge('c', overflow, { plainObjects: true });
             s2t.ok(utils.isOverflow(merged), 'result is also marked as overflow');
             s2t.deepEqual(merged, { __proto__: null, 0: 'c', 1: 'a', 2: 'b' }, 'creates null-proto object with primitive at 0');
+
             s2t.end();
         });
 
@@ -128,6 +133,7 @@ test('merge()', function (t) {
             s2t.ok(utils.isOverflow(overflow), 'overflow object is marked');
             var merged = utils.merge('a', overflow);
             s2t.deepEqual(merged, { 0: 'a', 1: 'b', 2: 'c', 3: 'd' }, 'shifts all source indices by 1');
+
             s2t.end();
         });
 
@@ -135,6 +141,7 @@ test('merge()', function (t) {
             var obj = { foo: 'bar' };
             var merged = utils.merge('a', obj);
             s2t.deepEqual(merged, ['a', { foo: 'bar' }], 'creates array with primitive and object');
+
             s2t.end();
         });
 
@@ -143,6 +150,7 @@ test('merge()', function (t) {
             var merged = utils.merge(arr, 'd', { arrayLimit: 1 });
             s2t.ok(utils.isOverflow(merged), 'result is marked as overflow');
             s2t.deepEqual(merged, { 0: 'a', 1: 'b', 2: 'c', 3: 'd' }, 'converts to overflow object with primitive appended');
+
             s2t.end();
         });
 
@@ -150,6 +158,78 @@ test('merge()', function (t) {
             var merged = utils.merge('a', ['b', 'c'], { arrayLimit: 1 });
             s2t.ok(utils.isOverflow(merged), 'result is marked as overflow');
             s2t.deepEqual(merged, { 0: 'a', 1: 'b', 2: 'c' }, 'converts to overflow object');
+
+            s2t.end();
+        });
+
+        st.test('merges primitive into array at the arrayLimit boundary, consistently with combine', function (s2t) {
+            var merged = utils.merge(['a'], 'b', { arrayLimit: 1 });
+            s2t.ok(utils.isOverflow(merged), 'result is marked as overflow at the boundary');
+            s2t.deepEqual(merged, { 0: 'a', 1: 'b' }, 'converts to overflow object instead of a length-2 array');
+
+            s2t.end();
+        });
+
+        st.test('merges two arrays that exceed arrayLimit into an overflow object', function (s2t) {
+            var merged = utils.merge(['a'], ['b'], { arrayLimit: 1 });
+            s2t.ok(utils.isOverflow(merged), 'result is marked as overflow');
+            s2t.deepEqual(merged, { 0: 'a', 1: 'b' }, 'array-into-array merge enforces arrayLimit like combine');
+
+            s2t.end();
+        });
+
+        st.test('throws at the arrayLimit boundary when merging a primitive into an array with throwOnLimitExceeded', function (s2t) {
+            s2t['throws'](
+                function () { utils.merge(['a'], 'b', { arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'throws when the resulting length would exceed arrayLimit'
+            );
+
+            s2t.end();
+        });
+
+        st.test('throws when merging two arrays past arrayLimit with throwOnLimitExceeded', function (s2t) {
+            s2t['throws'](
+                function () { utils.merge(['a'], ['b'], { arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'array-into-array merge throws rather than silently exceeding arrayLimit'
+            );
+            s2t['throws'](
+                function () { utils.merge(['a', 'b', 'c'], ['d', 'e', 'f'], { arrayLimit: 2, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 2 elements allowed in an array.'),
+                'uses the plural message when arrayLimit is not 1'
+            );
+
+            s2t.end();
+        });
+
+        st.test('throws instead of merging primitive into over-limit array when throwOnLimitExceeded is set', function (s2t) {
+            s2t['throws'](
+                function () { utils.merge(['a', 'b', 'c'], 'd', { arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'throws rather than converting to an overflow object'
+            );
+            s2t['throws'](
+                function () { utils.merge(['a', 'b', 'c'], 'd', { arrayLimit: 2, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 2 elements allowed in an array.'),
+                'uses the plural message when arrayLimit is not 1'
+            );
+
+            s2t.end();
+        });
+
+        st.test('throws instead of merging array into primitive when throwOnLimitExceeded is set', function (s2t) {
+            s2t['throws'](
+                function () { utils.merge('a', ['b', 'c'], { arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'throws rather than converting to an overflow object'
+            );
+            s2t['throws'](
+                function () { utils.merge('a', ['b', 'c', 'd'], { arrayLimit: 2, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 2 elements allowed in an array.'),
+                'uses the plural message when arrayLimit is not 1'
+            );
+
             s2t.end();
         });
 
@@ -274,6 +354,47 @@ test('combine()', function (t) {
         st.end();
     });
 
+    t.test('with throwOnLimitExceeded', function (st) {
+        st.test('throws when concatenation exceeds the limit', function (s2t) {
+            s2t['throws'](
+                function () { utils.combine(['a', 'b', 'c'], 'd', 3, false, true); },
+                new RangeError('Array limit exceeded. Only 3 elements allowed in an array.'),
+                'throws instead of converting to an overflow object'
+            );
+            s2t['throws'](
+                function () { utils.combine([], 'a', 0, false, true); },
+                new RangeError('Array limit exceeded. Only 0 elements allowed in an array.'),
+                'throws with the correct count at arrayLimit 0'
+            );
+            s2t.end();
+        });
+
+        st.test('throws when adding to an existing overflow object', function (s2t) {
+            var overflow = utils.combine(['a', 'b'], 'c', 0, false);
+            s2t.ok(utils.isOverflow(overflow), 'initial object is marked as overflow');
+
+            s2t['throws'](
+                function () { utils.combine(overflow, 'd', 0, false, true); },
+                new RangeError('Array limit exceeded. Only 0 elements allowed in an array.'),
+                'throws rather than appending to the overflow object'
+            );
+            s2t['throws'](
+                function () { utils.combine(overflow, 'd', 1, false, true); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'uses the singular message at arrayLimit 1'
+            );
+            s2t.end();
+        });
+
+        st.test('does not throw when within the limit', function (s2t) {
+            var combined = utils.combine(['a'], 'b', 5, false, true);
+            s2t.deepEqual(combined, ['a', 'b'], 'returns the array unchanged when under the limit');
+            s2t.end();
+        });
+
+        st.end();
+    });
+
     t.test('with existing overflow object', function (st) {
         st.test('adds to existing overflow object at next index', function (s2t) {
             // Create overflow object first via combine: 3 elements (indices 0-2) with limit 0
@@ -372,6 +493,79 @@ test('encode', function (t) {
         'encodes a long string'
     );
 
+    var boundary = '';
+    var expected = '';
+    for (var j = 0; j < 1023; j++) {
+        boundary += 'a';
+        expected += 'a';
+    }
+    boundary += '😀';
+    expected += '%F0%9F%98%80';
+
+    t.equal(
+        utils.encode(boundary),
+        expected,
+        'encodes a surrogate pair split across long-string chunks'
+    );
+
+    var laterBoundary = '';
+    var laterExpected = '';
+    for (var k = 0; k < 2047; k++) {
+        laterBoundary += 'a';
+        laterExpected += 'a';
+    }
+    laterBoundary += '😀';
+    laterExpected += '%F0%9F%98%80';
+
+    t.equal(
+        utils.encode(laterBoundary),
+        laterExpected,
+        'encodes a surrogate pair split across a later chunk boundary'
+    );
+
+    var twoPairs = '';
+    for (k = 0; k < 1023; k++) {
+        twoPairs += 'a';
+    }
+    twoPairs += '😀';
+    for (k = 0; k < 1022; k++) {
+        twoPairs += 'b';
+    }
+    twoPairs += '😀';
+
+    t.equal(
+        (utils.encode(twoPairs).match(/%F0%9F%98%80/g) || []).length,
+        2,
+        'encodes two surrogate pairs each split across a chunk boundary'
+    );
+
+    var roundTrip = '';
+    for (k = 0; k < 1023; k++) {
+        roundTrip += 'a';
+    }
+    roundTrip += '😀';
+
+    t.equal(
+        decodeURIComponent(utils.encode(roundTrip)),
+        roundTrip,
+        'a boundary-split surrogate pair round-trips through decodeURIComponent'
+    );
+
+    var loneBoundary = '';
+    var loneExpected = '';
+    for (k = 0; k < 1023; k++) {
+        loneBoundary += 'a';
+        loneExpected += 'a';
+    }
+    loneBoundary += '\uD83DX';
+    loneExpected += '%F0%9F%91%98';
+
+    t.equal(
+        utils.encode(loneBoundary),
+        loneExpected,
+        'a lone high surrogate at a chunk boundary encodes the same as mid-chunk'
+    );
+
     t.equal(
         utils.encode('\x28\x29'),
         '%28%29',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/cli",
-  "version": "6.71.15",
+  "version": "6.71.17",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "type": "module",
@@ -27,10 +27,10 @@
     "@opentelemetry/api": "1.9.0",
     "@opentelemetry/api-logs": "0.201.1",
     "@swc/core": "1.10.18",
-    "@zuplo/core": "6.71.15",
+    "@zuplo/core": "6.71.17",
     "@zuplo/editor": "1.0.20821740935",
-    "@zuplo/openapi-tools": "6.71.15",
-    "@zuplo/runtime": "6.71.15",
+    "@zuplo/openapi-tools": "6.71.17",
+    "@zuplo/runtime": "6.71.17",
     "chalk": "5.4.1",
     "chokidar": "3.5.3",
     "cookie": "1.0.2",
@@ -61,8 +61,8 @@
     "workerd": "1.20241230.0",
     "yargs": "17.7.2",
     "zod": "3.25.76",
-    "@zuplo/graphql": "6.71.15",
-    "@zuplo/otel": "6.71.15"
+    "@zuplo/graphql": "6.71.17",
+    "@zuplo/otel": "6.71.17"
   },
   "bundleDependencies": [
     "@inquirer/prompts",