ghost 6.64.0 → 6.65.0

package/core/server/services/themes/storage.js

@@ -75,6 +75,7 @@ module.exports = {
   setFromZip: async (zip, { copySettingsFrom } = {}) => {
     const themeName = getStorage().getSanitizedFileName(zip.name.split('.zip')[0]);
     const backupName = `${themeName}_${ObjectID()}`;
+    const stagingName = `${themeName}_${ObjectID()}`;
 
     // check if zip name matches one of the default themes
     if (zip.name === 'casper.zip' || zip.name === 'source.zip') {
@@ -111,6 +112,13 @@ module.exports = {
         await customThemeSettings.api.copySettingsBetweenThemes(copySettingsFrom, themeName);
       }
 
+      // CASE: copy the extracted theme in under a staging name first, so the live
+      // folder is only missing between the two renames below rather than for the whole copy
+      await getStorage().save({
+        name: stagingName,
+        path: checkedTheme.path,
+      });
+
       const themeExists = await getStorage().exists(themeName);
       // CASE: move the existing theme to a backup folder
       if (themeExists) {
@@ -119,11 +127,7 @@ module.exports = {
         await getStorage().rename(themeName, backupName);
       }
 
-      // CASE: store extracted theme
-      await getStorage().save({
-        name: themeName,
-        path: checkedTheme.path,
-      });
+      await getStorage().rename(stagingName, themeName);
 
       // CASE: loads the theme from the fs & sets the theme on the themeList
       const loadedTheme = await themeLoader.loadOneTheme(themeName);
@@ -152,20 +156,9 @@ module.exports = {
       }
 
       // restore backup if we renamed an existing theme but saving failed
-      if (renamedExisting) {
-        return getStorage()
-          .exists(themeName)
-          .then((themeExists) => {
-            if (!themeExists) {
-              return getStorage()
-                .rename(backupName, themeName)
-                .then(() => {
-                  throw error;
-                });
-            }
-
-            throw error;
-          });
+      // awaited so the finally block can't delete the backup before it's restored
+      if (renamedExisting && !(await getStorage().exists(themeName))) {
+        await getStorage().rename(backupName, themeName);
       }
 
       throw error;
@@ -178,12 +171,14 @@ module.exports = {
         });
       }
 
-      // CASE: remove the backup we created earlier
-      getStorage()
-        .delete(backupName)
-        .catch((err) => {
-          logging.error(new errors.InternalServerError({ err: err }));
-        });
+      // CASE: remove the backup and any staging copy left behind by a failure
+      for (const leftover of [backupName, stagingName]) {
+        getStorage()
+          .delete(leftover)
+          .catch((err) => {
+            logging.error(new errors.InternalServerError({ err: err }));
+          });
+      }
     }
   },
   destroy: async function (themeName) {
@@ -207,7 +202,7 @@ module.exports = {
       });
     }
 
-    let result = await getStorage().delete(themeName);
+    const result = await getStorage().delete(themeName);
     list.del(themeName);
     return result;
   },

package/core/server/services/themes/theme-storage.js

@@ -78,8 +78,8 @@ class ThemeStorage extends LocalStorageBase {
    * @param {string} destName
    */
   rename(srcName, destName) {
-    let src = path.join(this.getTargetDir(), srcName);
-    let dest = path.join(this.getTargetDir(), destName);
+    const src = path.join(this.getTargetDir(), srcName);
+    const dest = path.join(this.getTargetDir(), destName);
 
     return fs.move(src, dest);
   }

package/core/server/services/tiers/tier.js

@@ -251,21 +251,21 @@ module.exports = class Tier {
       });
     }
 
-    let name = validateName(data.name);
-
-    let slug = validateSlug(data.slug);
-    let description = validateDescription(data.description);
-    let welcomePageURL = validateWelcomePageURL(data.welcomePageURL);
-    let status = validateStatus(data.status || 'active');
-    let visibility = validateVisibility(data.visibility || 'public');
-    let type = validateType(data.type || 'paid');
-    let currency = validateCurrency(data.currency || null, type);
-    let trialDays = validateTrialDays(data.trialDays || 0, type);
-    let monthlyPrice = validateMonthlyPrice(data.monthlyPrice || null, type);
-    let yearlyPrice = validateYearlyPrice(data.yearlyPrice || null, type);
-    let createdAt = validateCreatedAt(data.createdAt);
-    let updatedAt = validateUpdatedAt(data.updatedAt);
-    let benefits = validateBenefits(data.benefits);
+    const name = validateName(data.name);
+
+    const slug = validateSlug(data.slug);
+    const description = validateDescription(data.description);
+    const welcomePageURL = validateWelcomePageURL(data.welcomePageURL);
+    const status = validateStatus(data.status || 'active');
+    const visibility = validateVisibility(data.visibility || 'public');
+    const type = validateType(data.type || 'paid');
+    const currency = validateCurrency(data.currency || null, type);
+    const trialDays = validateTrialDays(data.trialDays || 0, type);
+    const monthlyPrice = validateMonthlyPrice(data.monthlyPrice || null, type);
+    const yearlyPrice = validateYearlyPrice(data.yearlyPrice || null, type);
+    const createdAt = validateCreatedAt(data.createdAt);
+    const updatedAt = validateUpdatedAt(data.updatedAt);
+    const benefits = validateBenefits(data.benefits);
 
     const tier = new Tier({
       id,

package/core/server/services/tinybird-sync/index.js

@@ -9,12 +9,15 @@ const bson_objectid_1 = __importDefault(require("bson-objectid"));
 const logging_1 = __importDefault(require("@tryghost/logging"));
 const config_1 = __importDefault(require("../../../shared/config"));
 // @ts-expect-error This module lacks type definitions.
+const labs_1 = __importDefault(require("../../../shared/labs"));
+// @ts-expect-error This module lacks type definitions.
 const settings_cache_1 = __importDefault(require("../../../shared/settings-cache"));
 const db_1 = require("../../data/db");
 const tinybird_sync_service_1 = require("./tinybird-sync-service");
 const service = (0, tinybird_sync_service_1.createTinybirdSyncService)({
     config: config_1.default,
     settingsCache: settings_cache_1.default,
+    labs: labs_1.default,
     knex: db_1.knex,
     logging: logging_1.default,
     sleep: async (ms) => {

package/core/server/services/tinybird-sync/tinybird-sync-service.js

@@ -10,7 +10,7 @@ const BATCH_SIZE = 5000;
 const MAX_PAYLOAD_BYTES = 9 * 1024 * 1024;
 const MAX_PAYLOAD_MESSAGES = 1000;
 const REQUEST_TIMEOUT_MS = 5 * 60 * 1000;
-function createTinybirdSyncService({ config, settingsCache, knex, logging, sleep, random, now, fetch, createId, }) {
+function createTinybirdSyncService({ config, settingsCache, labs, knex, logging, sleep, random, now, fetch, createId, }) {
     let started = false;
     const syncAll = async (ingest) => {
         const results = await Promise.allSettled(sync_table_to_tinybird_1.AUTOMATION_SYNC_TARGETS.map(async (target) => {
@@ -34,9 +34,12 @@ function createTinybirdSyncService({ config, settingsCache, knex, logging, sleep
         }
     };
     const runLoop = async (ingest) => {
+        // Randomize the first wait to avoid all instances syncing at the same time.
         await sleep(Math.floor(random() * INTERVAL_MS));
         while (true) {
-            await syncAll(ingest);
+            if (labs.isSet('automationsTinybirdSync')) {
+                await syncAll(ingest);
+            }
             await sleep(INTERVAL_MS);
         }
     };
@@ -50,6 +53,8 @@ function createTinybirdSyncService({ config, settingsCache, knex, logging, sleep
             return;
         }
         started = true;
+        const isSyncEnabled = labs.isSet('automationsTinybirdSync');
+        logging.info({ system: { event: 'tinybird.sync.started' } }, `[Tinybird sync] Started: sync ${isSyncEnabled ? 'enabled' : 'disabled'} by labs flag (but may change)`);
         void runLoop(ingest)
             .then(() => {
             logging.error('[Tinybird sync] Loop stopped unexpectedly');

package/core/server/services/update-check/update-check-service.js

@@ -19,10 +19,10 @@ function normalizeNotifications(response) {
   if (!response) {
     return [];
   }
-  if (_.isArray(response.notifications)) {
+  if (Array.isArray(response.notifications)) {
     return response.notifications;
   }
-  if (_.isArray(response)) {
+  if (Array.isArray(response)) {
     return response;
   }
   if (response.messages) {
@@ -230,7 +230,7 @@ class UpdateCheckService {
    * @return {Promise}
    */
   async updateCheckResponse(response) {
-    let notificationGroups = (this.config.notificationGroups || []).concat(['all']);
+    const notificationGroups = (this.config.notificationGroups || []).concat(['all']);
 
     debug('Notification Groups', notificationGroups);
     debug('Response Update Check Service', response);

package/core/server/services/webhooks/serialize.js

@@ -42,7 +42,7 @@ module.exports =
     const changed = model._changed ? Object.keys(model._changed) : [];
 
     if (Object.keys(model.attributes).length) {
-      let frame = { options: { previous: false, context: { user: true } } };
+      const frame = { options: { previous: false, context: { user: true } } };
 
       // @NOTE: below options are lost during event processing, a more holistic approach would be
       //       to pass them somehow along with the model

package/core/server/web/api/app.js

@@ -1,5 +1,4 @@
 const debug = require('@tryghost/debug')('web:api:default:app');
-const config = require('../../../shared/config');
 const express = require('../../../shared/express');
 const sentry = require('../../../shared/sentry');
 const middleware = require('../shared/middleware');
@@ -13,10 +12,6 @@ module.exports = function setupApiApp() {
   debug('Parent API setup start');
   const apiApp = express('api');
 
-  if (config.get('server:testmode')) {
-    apiApp.use(require('./testmode')());
-  }
-
   apiApp.use(APIVersionCompatibilityService.versionRewrites);
   apiApp.use(APIVersionCompatibilityService.contentVersion);
 

package/core/server/web/api/middleware/upload.js

@@ -324,6 +324,20 @@ const writeSvg = async (filepath, content, isZipped = false) => {
 
   return await fs.writeFile(filepath, content);
 };
+
+/**
+ *
+ * @param {{ext: string, type: string}} file
+ * @returns {boolean}
+ *
+ * Extension and content type are allowlisted separately, so a file counts as an SVG if either
+ * one says so. Storage adapters that use the content type (e.g. S3) would otherwise serve an
+ * unsanitized SVG uploaded with a non-SVG extension as image/svg+xml.
+ */
+const isSvgFile = (file) => {
+  return file.ext === '.svg' || file.ext === '.svgz' || file.type === 'image/svg+xml';
+};
+
 /**
  *
  * @param {Object} options
@@ -369,7 +383,7 @@ const validation = function ({ type }) {
     }
 
     // Sanitize SVG files
-    if (req.file.ext === '.svg' || req.file.ext === '.svgz') {
+    if (isSvgFile(req.file)) {
       const sanitized = await sanitizeSvg(req.file.path, req.file.ext === '.svgz');
 
       if (!sanitized) {
@@ -392,7 +406,7 @@ const validation = function ({ type }) {
  * @returns {import('express').RequestHandler}
  */
 const mediaValidation = function ({ type }) {
-  return function mediaUploadValidation(req, res, next) {
+  return async function mediaUploadValidation(req, res, next) {
     const extensions =
       (config.get('uploads')[type] && config.get('uploads')[type].extensions) || [];
     const contentTypes =
@@ -448,6 +462,19 @@ const mediaValidation = function ({ type }) {
           }),
         );
       }
+
+      // Sanitize SVG thumbnails
+      if (isSvgFile(req.thumbnail)) {
+        const sanitized = await sanitizeSvg(req.thumbnail.path, req.thumbnail.ext === '.svgz');
+
+        if (!sanitized) {
+          return next(
+            new errors.UnsupportedMediaTypeError({
+              message: tpl(messages.svg.invalidFile),
+            }),
+          );
+        }
+      }
     }
 
     next();

package/core/server/web/parent/middleware/index.js

@@ -3,6 +3,6 @@ module.exports = {
   filterQueryParameters: require('./filter-query-parameters').filterQueryParameters,
   ghostLocals: require('./ghost-locals').ghostLocals,
   logRequest: require('./log-request'),
-  queueRequest: require('./queue-request'),
+  queueRequest: require('./queue-request').queueRequest,
   requestId: require('./request-id').requestId,
 };

package/core/server/web/parent/middleware/log-request.js

@@ -12,6 +12,11 @@ module.exports = function logRequest(req, res, next) {
   const startTime = Date.now();
 
   function logResponse() {
+    // 'close' before 'finish' means the client went away before we responded
+    if (!res.writableFinished) {
+      res.statusCode = 499;
+    }
+
     res.responseTime = Date.now() - startTime + 'ms';
     req.userId = req.user ? (req.user.id ? req.user.id : req.user) : null;
 

package/core/server/web/parent/middleware/queue-request.js

@@ -1,62 +1,107 @@
-const errors = require('@tryghost/errors');
-const logging = require('@tryghost/logging');
-const path = require('node:path');
-const expressQueue = require('express-queue');
-
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queueRequest = queueRequest;
+const node_path_1 = __importDefault(require("node:path"));
+const errors_1 = __importDefault(require("@tryghost/errors"));
+const logging_1 = __importDefault(require("@tryghost/logging"));
 const debug = (message) => {
-  logging.debug(`[queue-request] ${message}`);
+    logging_1.default.debug(`[queue-request] ${message}`);
 };
-
-module.exports = function queueRequest(config, queueFactory = expressQueue) {
-  if (config.concurrencyLimit === undefined) {
-    throw new errors.IncorrectUsageError({
-      message: 'concurrencyLimit must be defined when using queueRequest middleware',
-    });
-  }
-
-  debug(`Initialising queueRequest middleware with config: ${JSON.stringify(config)}`);
-
-  // @see https://github.com/alykoshin/express-queue#usage
-  const queue = queueFactory({
-    activeLimit: config.concurrencyLimit,
-    queuedLimit: -1, // Do not limit the number of queued requests
-  });
-
-  /**
-   * Available events:
-   * - queue - when a request is queued
-   * - dequeue - when a request is dequeued
-   * - process - when a request is being processed
-   * - reject - when a request is rejected
-   * - cancel - when a request is cancelled
-   * - complete - when a request has completed
-   *
-   * @see https://github.com/search?q=repo:alykoshin/mini-queue%20job._toState&type=code
-   */
-  queue.queue.on('queue', (job) => {
-    debug(`Request queued: ${job.data.req.path}`);
-  });
-
-  queue.queue.on('complete', (job) => {
-    debug(`Request completed: ${job.data.req.path}`);
-  });
-
-  /**
-   * @param {import('express').Request} req
-   * @param {import('express').Response} res
-   * @param {import('express').NextFunction} next
-   */
-  return function queueRequestMw(req, res, next) {
-    req.queueDepth = queue.queue.getLength();
-
-    // Do not queue requests for static assets - We assume that any path
-    // with a file extension is a static asset
-    if (path.extname(req.path)) {
-      debug(`Request for assumed static asset skipping queue: ${req.path}`);
-
-      return next();
+/**
+ * Limits how many dynamic requests are processed at once, holding the rest in
+ * a FIFO queue.
+ *
+ * A slot is released when the response is ended or the connection closes,
+ * whichever happens first, so a handler that never ends its response cannot
+ * hold a slot forever. Work abandoned by a disconnected client may keep running
+ * after its slot has been handed on.
+ */
+function queueRequest(config) {
+    if (config.concurrencyLimit === undefined) {
+        throw new errors_1.default.IncorrectUsageError({
+            message: 'concurrencyLimit must be defined when using queueRequest middleware',
+        });
     }
-
-    return queue(req, res, next);
-  };
-};
+    const concurrencyLimit = config.concurrencyLimit;
+    if (!Number.isInteger(concurrencyLimit) || concurrencyLimit <= 0) {
+        throw new errors_1.default.IncorrectUsageError({
+            message: 'concurrencyLimit must be a positive integer',
+        });
+    }
+    // Set iterates in insertion order and deletes in O(1), so cancelling a deep queue stays cheap
+    const queue = new Set();
+    let activeCount = 0;
+    let drainScheduled = false;
+    function start({ req, res, next, queuedAt }) {
+        activeCount += 1;
+        req.extra = { ...req.extra, queueWaitMs: Date.now() - queuedAt };
+        let released = false;
+        const release = () => {
+            if (released) {
+                return;
+            }
+            released = true;
+            activeCount -= 1;
+            debug(`Request completed: ${req.path}`);
+            scheduleStartNext();
+        };
+        const end = res.end;
+        res.end = function (...args) {
+            res.end = end;
+            release();
+            return end.apply(this, args);
+        };
+        res.once('close', release);
+        next();
+    }
+    // Deferred and bounded so handlers that respond synchronously neither grow the
+    // stack per queued request nor drain a deep backlog without yielding to I/O
+    function scheduleStartNext() {
+        if (drainScheduled) {
+            return;
+        }
+        drainScheduled = true;
+        setImmediate(() => {
+            drainScheduled = false;
+            startNext();
+        });
+    }
+    function startNext() {
+        const availableSlots = concurrencyLimit - activeCount;
+        for (let started = 0; started < availableSlots && queue.size > 0; started += 1) {
+            const [entry] = queue;
+            queue.delete(entry);
+            entry.res.removeListener('close', entry.cancel);
+            start(entry);
+        }
+    }
+    return function queueRequestMw(req, res, next) {
+        req.queueDepth = queue.size;
+        // Do not queue requests for static assets - We assume that any path
+        // with a file extension is a static asset
+        if (node_path_1.default.extname(req.path)) {
+            debug(`Request for assumed static asset skipping queue: ${req.path}`);
+            return next();
+        }
+        const entry = {
+            req,
+            res,
+            next,
+            queuedAt: Date.now(),
+            cancel: () => {
+                queue.delete(entry);
+                debug(`Request cancelled while queued: ${req.path}`);
+            },
+        };
+        // an empty-queue check keeps arrivals behind requests awaiting a deferred start
+        if (activeCount < concurrencyLimit && queue.size === 0) {
+            return start(entry);
+        }
+        debug(`Request queued: ${req.path}`);
+        queue.add(entry);
+        res.once('close', entry.cancel);
+    };
+}

package/core/server/web/shared/middleware/api/spam-prevention.js

@@ -42,8 +42,8 @@ let spamMemberLogin = spam.member_login || {};
 let spamCheckoutSessionGlobal = spam.checkout_session_global || {};
 let spamCheckoutSessionEmail = spam.checkout_session_email || {};
 let spamContentApiKey = spam.content_api_key || {};
-let spamWebmentionsBlock = spam.webmentions_block || {};
-let spamEmailPreviewBlock = spam.email_preview_block || {};
+const spamWebmentionsBlock = spam.webmentions_block || {};
+const spamEmailPreviewBlock = spam.email_preview_block || {};
 let spamOtcVerificationEnumeration = spam.otc_verification_enumeration || {};
 let spamOtcVerification = spam.otc_verification || {};
 

package/core/shared/config/defaults.json

@@ -71,6 +71,10 @@
     "active": "LocalImagesStorage",
     "media": "LocalMediaStorage",
     "files": "LocalFilesStorage",
+    "imports": {
+      "adapter": "LocalStorageBase",
+      "staticFileURLPrefix": "content/imports"
+    },
     "LocalMediaStorage": {},
     "LocalFilesStorage": {}
   },
@@ -363,7 +367,8 @@
   },
   "bulkEmail": {
     "batchSize": 1000,
-    "captureLinkClickBadMemberUuid": false
+    "captureLinkClickBadMemberUuid": false,
+    "perRecipientMessageId": false
   },
   "disableJSBackups": false,
   "disableMigrationBackups": false,

package/core/shared/custom-theme-settings-cache/custom-theme-settings-service.js

@@ -238,7 +238,7 @@ module.exports = class CustomThemeSettingsService {
       return [];
     }
 
-    let removedIds = [];
+    const removedIds = [];
 
     // sync any knownSettings that have changed in the theme
     for (const knownSetting of knownSettings) {

package/core/shared/labs.js

@@ -48,6 +48,7 @@ const PRIVATE_FEATURES = [
   'importMemberTier',
   'csvContentImporter',
   'adminUIRefresh',
+  'admin7Pill',
   'tagsX',
   'emailUniqueid',
   'improveSendingUI',
@@ -63,6 +64,7 @@ const PRIVATE_FEATURES = [
   'postsListReact',
   'membersActivityReact',
   'editorReact',
+  'dunningWarnings',
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];
@@ -119,7 +121,6 @@ module.exports.isSet = function isSet(flag) {
  */
 module.exports.enabledHelper = function enabledHelper(options, callback) {
   const errDetails = {};
-  let errString;
 
   if (module.exports.isSet(options.flagKey) === true) {
     // helper is active, use the callback
@@ -145,7 +146,7 @@ module.exports.enabledHelper = function enabledHelper(options, callback) {
   );
 
   const { SafeString } = require('express-hbs');
-  errString = new SafeString(
+  const errString = new SafeString(
     `<script>console.error("${_.values(errDetails).join(' ')}");</script>`,
   );
 

package/core/shared/settings-cache/cache-manager.js

@@ -240,7 +240,7 @@ class CacheManager {
   getPublic() {
     // This block correctly builds the type signature for the return value
     /** @type {PublicSettingsCache} */
-    let settings = Object.fromEntries(
+    const settings = Object.fromEntries(
       Object.keys(this.publicSettings).map((key) => [this.publicSettings[key], null]),
     );
 

package/nodemon.json

@@ -1,6 +1,6 @@
 {
   "watch": [".", "../*"],
-  "ignore": ["../admin/**", "content/**", "core/built/**"],
+  "ignore": ["../admin/**", "content/**", "core/built/**", "test/**"],
   "ext": "js,mjs,cjs,json,ts,tsx",
   "exec": "node --conditions=source --import=tsx"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "6.64.0",
+  "version": "6.65.0",
   "description": "The professional publishing platform",
   "keywords": [
     "blog",
@@ -54,7 +54,7 @@
     "@tryghost/adapter-base-jobs": "file:components/tryghost-adapter-base-jobs-0.0.0.tgz",
     "@tryghost/adapter-base-redirects": "file:components/tryghost-adapter-base-redirects-0.0.0.tgz",
     "@tryghost/adapter-base-route-settings": "file:components/tryghost-adapter-base-route-settings-0.0.0.tgz",
-    "@tryghost/adapter-base-scheduling": "file:components/tryghost-adapter-base-scheduling-0.2.3.tgz",
+    "@tryghost/adapter-base-scheduling": "file:components/tryghost-adapter-base-scheduling-0.2.4.tgz",
     "@tryghost/adapter-base-sso": "file:components/tryghost-adapter-base-sso-0.1.3.tgz",
     "@tryghost/admin-api-schema": "file:components/tryghost-admin-api-schema-0.0.0.tgz",
     "@tryghost/api-framework": "file:components/tryghost-api-framework-0.0.0.tgz",
@@ -141,7 +141,6 @@
     "express-jwt": "8.5.1",
     "express-lazy-router": "1.0.6",
     "express-query-boolean": "2.0.0",
-    "express-queue": "0.0.13",
     "express-session": "1.19.0",
     "fastq": "^1.20.1",
     "file-type": "21.3.4",
@@ -160,6 +159,7 @@
     "iconv-lite": "0.7.3",
     "image-size": "1.2.1",
     "intl-messageformat": "5.4.3",
+    "ipaddr.js": "2.5.0",
     "jose": "6.2.12",
     "js-yaml": "4.3.0",
     "jsdom": "30.0.1",
@@ -167,7 +167,7 @@
     "jsonwebtoken": "8.5.1",
     "juice": "11.1.1",
     "knex": "2.4.2",
-    "knex-migrator": "5.4.1",
+    "knex-migrator": "6.2.1",
     "leaky-bucket": "2.2.0",
     "lodash": "4.18.1",
     "luxon": "3.7.2",
@@ -188,7 +188,7 @@
     "moment-timezone": "0.5.45",
     "mppx": "0.6.20",
     "multer": "2.2.0",
-    "mysql2": "3.22.5",
+    "mysql2": "3.24.4",
     "nconf": "0.13.0",
     "node-html-markdown": "2.0.0",
     "nodemailer": "8.0.11",
@@ -212,7 +212,6 @@
     "type-fest": "5.7.0",
     "ua-parser-js": "1.0.41",
     "unidecode": "1.1.0",
-    "xml": "1.0.1",
     "zod": "4.4.3"
   },
   "optionalDependencies": {
@@ -226,5 +225,5 @@
     "node": "^22.23.1 || ^24.20.0"
   },
   "scripts": {},
-  "packageManager": "pnpm@12.4.0+sha512.37536c26ed40ab4134b6511e09f6b27f3ebb45687468f2406ca3805279a4e5ca158c1931350ad9774d6ab2108d71b3dbaeb39943159294375e4d053e8e05685c"
+  "packageManager": "pnpm@12.4.2+sha512.08adc6613180275c7c9edada39dcf08c9c61ad4e7eaf330a4f3461f102b0f907423454d117f98e72d47fef0616070644d7bffc973a6a57f5090a6d7c368b07c9"
 }