pakstr 0.27.0 → 0.29.0

package/android-template/app/src/main/java/com/pakstr/app/utils/SignerPickerBottomSheet.kt

@@ -1,9 +1,11 @@
 package com.pakstr.app.utils
 
+import android.content.DialogInterface
 import android.os.Bundle
 import android.view.LayoutInflater
 import android.view.View
 import android.view.ViewGroup
+import android.view.WindowManager
 import android.widget.Button
 import android.widget.RadioGroup
 import com.google.android.material.bottomsheet.BottomSheetDialogFragment
@@ -13,10 +15,14 @@ import com.pakstr.app.R
 
 class SignerPickerBottomSheet(
     private val hasBunkerSession: Boolean,
+    private val hasLocalAccount: Boolean,
     private val onAmberSelected: () -> Unit,
     private val onBunkerSelected: (String) -> Boolean,
+    private val onLocalSelected: () -> Unit,
+    private val onLocalImportSelected: (String) -> Boolean,
     private val onSharePairing: (List<String>) -> Unit,
-    private val onBunkerLogout: () -> Unit
+    private val onBunkerLogout: () -> Unit,
+    private val onDismissed: () -> Unit = {}
 ) : BottomSheetDialogFragment() {
 
     override fun onCreateView(
@@ -31,6 +37,11 @@ class SignerPickerBottomSheet(
         )
     }
 
+    override fun onStart() {
+        super.onStart()
+        dialog?.window?.addFlags(WindowManager.LayoutParams.FLAG_SECURE)
+    }
+
     override fun onViewCreated(
         view: View,
         savedInstanceState: Bundle?
@@ -39,6 +50,11 @@ class SignerPickerBottomSheet(
         val radioGroup = view.findViewById<RadioGroup>(R.id.options_radio_group)
         val uriContainer = view.findViewById<TextInputLayout>(R.id.bunker_uri_container)
         val uriInput = view.findViewById<TextInputEditText>(R.id.bunker_uri)
+        val localActions = view.findViewById<View>(R.id.local_account_actions)
+        val localExisting = view.findViewById<View>(R.id.local_account_existing)
+        val localActionGroup = view.findViewById<RadioGroup>(R.id.local_action_radio_group)
+        val nsecContainer = view.findViewById<TextInputLayout>(R.id.local_nsec_container)
+        val nsecInput = view.findViewById<TextInputEditText>(R.id.local_nsec)
         val confirm = view.findViewById<Button>(R.id.button_confirm)
         val sharePairing = view.findViewById<Button>(R.id.button_share_pairing)
         val logout = view.findViewById<Button>(R.id.button_logout_bunker)
@@ -46,30 +62,88 @@ class SignerPickerBottomSheet(
         logout.visibility =
             if (hasBunkerSession) View.VISIBLE else View.GONE
 
-        fun updateBunkerControls() {
+        fun updateControls() {
             val bunkerSelected =
                 radioGroup.checkedRadioButtonId == R.id.radio_option_two
+            val localSelected =
+                radioGroup.checkedRadioButtonId == R.id.radio_option_three
             uriContainer.visibility =
                 if (bunkerSelected) View.VISIBLE else View.GONE
             sharePairing.visibility =
                 if (bunkerSelected) View.VISIBLE else View.GONE
+            localActions.visibility =
+                if (localSelected && !hasLocalAccount) {
+                    View.VISIBLE
+                } else {
+                    View.GONE
+                }
+            localExisting.visibility =
+                if (localSelected && hasLocalAccount) {
+                    View.VISIBLE
+                } else {
+                    View.GONE
+                }
+            nsecContainer.visibility =
+                if (
+                    localSelected &&
+                    !hasLocalAccount &&
+                    localActionGroup.checkedRadioButtonId ==
+                    R.id.radio_local_import
+                ) {
+                    View.VISIBLE
+                } else {
+                    View.GONE
+                }
         }
         radioGroup.setOnCheckedChangeListener { _, _ ->
             uriContainer.error = null
-            updateBunkerControls()
+            nsecContainer.error = null
+            if (radioGroup.checkedRadioButtonId != R.id.radio_option_three) {
+                nsecInput.text?.clear()
+            }
+            updateControls()
+        }
+        localActionGroup.setOnCheckedChangeListener { _, _ ->
+            nsecContainer.error = null
+            if (
+                localActionGroup.checkedRadioButtonId !=
+                R.id.radio_local_import
+            ) {
+                nsecInput.text?.clear()
+            }
+            updateControls()
         }
-        updateBunkerControls()
+        updateControls()
 
         confirm.setOnClickListener {
-            if (radioGroup.checkedRadioButtonId == R.id.radio_option_two) {
-                val value = uriInput.text?.toString().orEmpty().trim()
-                if (!onBunkerSelected(value)) {
-                    uriContainer.error =
-                        getString(R.string.signer_picker_invalid_bunker)
-                    return@setOnClickListener
+            when (radioGroup.checkedRadioButtonId) {
+                R.id.radio_option_two -> {
+                    val value = uriInput.text?.toString().orEmpty().trim()
+                    if (!onBunkerSelected(value)) {
+                        uriContainer.error =
+                            getString(R.string.signer_picker_invalid_bunker)
+                        return@setOnClickListener
+                    }
+                }
+                R.id.radio_option_three -> {
+                    val importing =
+                        !hasLocalAccount &&
+                                localActionGroup.checkedRadioButtonId ==
+                                R.id.radio_local_import
+                    if (importing) {
+                        val value =
+                            nsecInput.text?.toString().orEmpty().trim()
+                        if (!onLocalImportSelected(value)) {
+                            nsecContainer.error =
+                                getString(R.string.signer_picker_local_invalid)
+                            return@setOnClickListener
+                        }
+                        nsecInput.text?.clear()
+                    } else {
+                        onLocalSelected()
+                    }
                 }
-            } else {
-                onAmberSelected()
+                else -> onAmberSelected()
             }
             dismiss()
         }
@@ -98,4 +172,16 @@ class SignerPickerBottomSheet(
             dismiss()
         }
     }
+
+    override fun onDestroyView() {
+        view?.findViewById<TextInputEditText>(R.id.local_nsec)
+            ?.text
+            ?.clear()
+        super.onDestroyView()
+    }
+
+    override fun onDismiss(dialog: DialogInterface) {
+        super.onDismiss(dialog)
+        onDismissed()
+    }
 }

package/android-template/app/src/main/res/layout/activity_developer_tools.xml

@@ -208,6 +208,21 @@
                             android:layout_height="wrap_content"
                             android:textColor="?android:attr/textColorSecondary" />
                     </LinearLayout>
+
+                    <TextView
+                        style="@style/TextAppearance.MaterialComponents.Subtitle2"
+                        android:layout_width="match_parent"
+                        android:layout_height="wrap_content"
+                        android:layout_marginTop="12dp"
+                        android:text="@string/developer_tools_chrome_webview_inspection" />
+
+                    <TextView
+                        style="@style/TextAppearance.MaterialComponents.Caption"
+                        android:layout_width="match_parent"
+                        android:layout_height="wrap_content"
+                        android:layout_marginTop="4dp"
+                        android:text="@string/developer_tools_chrome_webview_inspection_note"
+                        android:textColor="?android:attr/textColorSecondary" />
                 </LinearLayout>
             </com.google.android.material.card.MaterialCardView>
 

package/android-template/app/src/main/res/layout/dialog_picker.xml

@@ -77,8 +77,88 @@
             android:text="@string/signer_picker_bunker"
             android:textColor="#1F2937"
             android:textSize="16sp" />
+
+        <RadioButton
+            android:id="@+id/radio_option_three"
+            android:layout_width="match_parent"
+            android:layout_height="64dp"
+            android:layout_marginBottom="12dp"
+            android:background="@drawable/selector_radio_card"
+            android:button="@null"
+            android:drawableStart="@drawable/ic_menu_browser"
+            android:drawableEnd="@drawable/selector_radio_checkmark"
+            android:drawablePadding="16dp"
+            android:drawableTint="@drawable/selector_radio_tint"
+            android:fontFamily="sans-serif-medium"
+            android:paddingStart="20dp"
+            android:paddingEnd="20dp"
+            android:text="@string/signer_picker_local"
+            android:textColor="#1F2937"
+            android:textSize="16sp" />
     </RadioGroup>
 
+    <LinearLayout
+        android:id="@+id/local_account_actions"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:layout_marginBottom="12dp"
+        android:orientation="vertical"
+        android:paddingStart="16dp"
+        android:paddingEnd="16dp"
+        android:visibility="gone">
+
+        <RadioGroup
+            android:id="@+id/local_action_radio_group"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:orientation="vertical">
+
+            <RadioButton
+                android:id="@+id/radio_local_create"
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:checked="true"
+                android:text="@string/signer_picker_local_create" />
+
+            <RadioButton
+                android:id="@+id/radio_local_import"
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:text="@string/signer_picker_local_import" />
+        </RadioGroup>
+
+        <com.google.android.material.textfield.TextInputLayout
+            android:id="@+id/local_nsec_container"
+            style="@style/Widget.MaterialComponents.TextInputLayout.OutlinedBox"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="8dp"
+            android:hint="@string/signer_picker_local_nsec_hint"
+            android:visibility="gone"
+            app:endIconMode="password_toggle">
+
+            <com.google.android.material.textfield.TextInputEditText
+                android:id="@+id/local_nsec"
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:importantForAutofill="no"
+                android:inputType="textPassword|textNoSuggestions"
+                android:maxLines="1"
+                android:saveEnabled="false" />
+        </com.google.android.material.textfield.TextInputLayout>
+    </LinearLayout>
+
+    <TextView
+        android:id="@+id/local_account_existing"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:layout_marginBottom="12dp"
+        android:paddingStart="16dp"
+        android:paddingEnd="16dp"
+        android:text="@string/signer_picker_local_existing"
+        android:textColor="#4B5563"
+        android:visibility="gone" />
+
     <com.google.android.material.textfield.TextInputLayout
         android:id="@+id/bunker_uri_container"
         style="@style/Widget.MaterialComponents.TextInputLayout.OutlinedBox"

package/android-template/app/src/main/res/values/strings.xml

@@ -32,6 +32,8 @@
     <string name="developer_tools_api_base_save_failed">Unable to persist the API Base URL setting.</string>
     <string name="developer_tools_api_base_invalid">Enter an absolute HTTPS URL without credentials, query, or fragment.</string>
     <string name="developer_tools_webview_debug">WebView Debug</string>
+    <string name="developer_tools_chrome_webview_inspection">Chrome WebView Inspection</string>
+    <string name="developer_tools_chrome_webview_inspection_note">To inspect this app in Chrome DevTools, enable Developer options → USB debugging on your Android device. This is required even when connecting over Wi-Fi.</string>
     <string name="developer_tools_enabled">Enabled</string>
     <string name="developer_tools_disabled">Disabled</string>
 
@@ -66,9 +68,22 @@
 
     <string name="signer_settings">Signer settings</string>
     <string name="signer_picker_title">Choose a signer</string>
-    <string name="signer_picker_subtitle">Use Amber or connect to a NIP-46 remote signer.</string>
+    <string name="signer_picker_subtitle">Use Amber, connect to a remote signer, or use an app-local account.</string>
     <string name="signer_picker_amber">Continue with Amber</string>
     <string name="signer_picker_bunker">Connect to remote signer (Bunker)</string>
+    <string name="signer_picker_local">App-local account</string>
+    <string name="signer_picker_local_create">Create new account</string>
+    <string name="signer_picker_local_import">Import existing account</string>
+    <string name="signer_picker_local_nsec_hint">Enter your nsec</string>
+    <string name="signer_picker_local_existing">Use the existing app-local account on this device.</string>
+    <string name="signer_picker_local_invalid">Enter a valid lowercase nsec.</string>
+    <string name="signer_picker_local_confirm_title">Confirm account import</string>
+    <string name="signer_picker_local_confirm_message">Import this account?\n\n%1$s</string>
+    <string name="signer_picker_local_confirm">Import</string>
+    <string name="signer_picker_local_cancel">Cancel</string>
+    <string name="signer_picker_local_failed">Unable to create the app-local account.</string>
+    <string name="signer_picker_local_status_failed">Unable to check the app-local account.</string>
+    <string name="signer_picker_local_import_failed">Unable to import the app-local account.</string>
     <string name="signer_picker_bunker_hint">Paste a bunker:// connection</string>
     <string name="signer_picker_share_pairing">Share a nostrconnect:// pairing</string>
     <string name="signer_picker_logout_bunker">Disconnect remote signer</string>

package/android-template/app/src/main/res/xml/backup_rules.xml

@@ -1,13 +1,6 @@
-<?xml version="1.0" encoding="utf-8"?><!--
-   Sample backup rules file; uncomment and customize as necessary.
-   See https://developer.android.com/guide/topics/data/autobackup
-   for details.
-   Note: This file is ignored for devices older than API 31
-   See https://developer.android.com/about/versions/12/backup-restore
--->
+<?xml version="1.0" encoding="utf-8"?>
 <full-backup-content>
-    <!--
-   <include domain="sharedpref" path="."/>
-   <exclude domain="sharedpref" path="device.xml"/>
--->
+    <exclude
+        domain="sharedpref"
+        path="local_signer_account.xml" />
 </full-backup-content>

package/android-template/app/src/main/res/xml/data_extraction_rules.xml

@@ -1,19 +1,13 @@
-<?xml version="1.0" encoding="utf-8"?><!--
-   Sample data extraction rules file; uncomment and customize as necessary.
-   See https://developer.android.com/about/versions/12/backup-restore#xml-changes
-   for details.
--->
+<?xml version="1.0" encoding="utf-8"?>
 <data-extraction-rules>
     <cloud-backup>
-        <!-- TODO: Use <include> and <exclude> to control what is backed up.
-        <include .../>
-        <exclude .../>
-        -->
+        <exclude
+            domain="sharedpref"
+            path="local_signer_account.xml" />
     </cloud-backup>
-    <!--
     <device-transfer>
-        <include .../>
-        <exclude .../>
+        <exclude
+            domain="sharedpref"
+            path="local_signer_account.xml" />
     </device-transfer>
-    -->
 </data-extraction-rules>

package/android-template/app/src/test/java/com/pakstr/app/crypto/Nip19CodecTest.kt

@@ -0,0 +1,178 @@
+package com.pakstr.app.crypto
+
+import com.pakstr.app.signer.local.LocalAccountImportCandidate
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertThrows
+import org.junit.Test
+
+class Nip19CodecTest {
+
+    @Test
+    fun decodes_known_nsec_vector() {
+        val decoded = Nip19Codec.decodeNsec(NSEC_ONE)
+
+        assertArrayEquals(
+            ByteArray(32).also { it[31] = 1 },
+            decoded
+        )
+        decoded.fill(0)
+    }
+
+    @Test
+    fun encodes_known_npub_vector() {
+        val publicKey = Bip340Hash.hexToBytes(PUBLIC_KEY_ONE)
+
+        try {
+            assertEquals(NPUB_ONE, Nip19Codec.encodeNpub(publicKey))
+        } finally {
+            publicKey.fill(0)
+        }
+    }
+
+    @Test
+    fun import_candidate_derives_expected_npub_and_closes_key() {
+        val candidate = LocalAccountImportCandidate.parse(NSEC_ONE)
+
+        assertEquals(NPUB_ONE, candidate.npub)
+        assertFalse(candidate.toString().contains(NSEC_ONE))
+        candidate.close()
+        assertThrows(IllegalStateException::class.java) {
+            candidate.withPrivateKey { }
+        }
+    }
+
+    @Test
+    fun rejects_noncanonical_or_corrupt_nsec() {
+        val invalid = listOf(
+            NSEC_ONE.uppercase(),
+            "Nsec" + NSEC_ONE.substring(4),
+            "xsec" + NSEC_ONE.substring(4),
+            NSEC_ONE.dropLast(1) + "q",
+            NSEC_ONE.replaceRange(8, 9, "i"),
+            NSEC_ONE.dropLast(1),
+            NSEC_ONE + "q"
+        )
+
+        invalid.forEach { value ->
+            assertThrows(InvalidNsecException::class.java) {
+                Nip19Codec.decodeNsec(value)
+            }
+        }
+    }
+
+    @Test
+    fun rejects_invalid_private_scalars() {
+        val zero = encodeNsecForTest(ByteArray(32))
+        val order = Bip340Hash.hexToBytes(SECP256K1_ORDER)
+        val aboveOrder = order.copyOf().also {
+            it[it.lastIndex] = (it.last().toInt() + 1).toByte()
+        }
+
+        try {
+            assertThrows(IllegalArgumentException::class.java) {
+                LocalAccountImportCandidate.parse(zero)
+            }
+            assertThrows(IllegalArgumentException::class.java) {
+                LocalAccountImportCandidate.parse(
+                    encodeNsecForTest(order)
+                )
+            }
+            assertThrows(IllegalArgumentException::class.java) {
+                LocalAccountImportCandidate.parse(
+                    encodeNsecForTest(aboveOrder)
+                )
+            }
+        } finally {
+            order.fill(0)
+            aboveOrder.fill(0)
+        }
+    }
+
+    @Test
+    fun rejects_wrong_payload_lengths_and_accepts_leading_zero() {
+        assertThrows(InvalidNsecException::class.java) {
+            Nip19Codec.decodeNsec(encodeNsecForTest(ByteArray(31)))
+        }
+        assertThrows(InvalidNsecException::class.java) {
+            Nip19Codec.decodeNsec(encodeNsecForTest(ByteArray(33)))
+        }
+
+        LocalAccountImportCandidate.parse(NSEC_ONE).use { candidate ->
+            assertEquals(NPUB_ONE, candidate.npub)
+        }
+    }
+
+    private fun encodeNsecForTest(bytes: ByteArray): String {
+        val data = convertBits(bytes)
+        val values = hrpExpand("nsec") + data + IntArray(6)
+        val checksum = polymod(values) xor 1
+        val check = IntArray(6) { index ->
+            (checksum shr (5 * (5 - index))) and 31
+        }
+        return "nsec1" + (data + check).joinToString("") {
+            CHARSET[it].toString()
+        }
+    }
+
+    private fun convertBits(bytes: ByteArray): IntArray {
+        var accumulator = 0
+        var bits = 0
+        val output = ArrayList<Int>()
+        bytes.forEach { byte ->
+            accumulator = (accumulator shl 8) or (byte.toInt() and 0xff)
+            bits += 8
+            while (bits >= 5) {
+                bits -= 5
+                output += (accumulator shr bits) and 31
+            }
+        }
+        if (bits > 0) {
+            output += (accumulator shl (5 - bits)) and 31
+        }
+        return output.toIntArray()
+    }
+
+    private fun hrpExpand(hrp: String): IntArray =
+        IntArray(hrp.length * 2 + 1).also { result ->
+            hrp.forEachIndexed { index, character ->
+                result[index] = character.code shr 5
+                result[hrp.length + 1 + index] = character.code and 31
+            }
+        }
+
+    private fun polymod(values: IntArray): Int {
+        var checksum = 1
+        val generators = intArrayOf(
+            0x3b6a57b2,
+            0x26508e6d,
+            0x1ea119fa,
+            0x3d4233dd,
+            0x2a1462b3
+        )
+        values.forEach { value ->
+            val top = checksum ushr 25
+            checksum = (checksum and 0x1ffffff) shl 5 xor value
+            generators.forEachIndexed { index, generator ->
+                if ((top shr index) and 1 != 0) {
+                    checksum = checksum xor generator
+                }
+            }
+        }
+        return checksum
+    }
+
+    private companion object {
+        const val CHARSET =
+            "qpzry9x8gf2tvdw0s3jn54khce6mua7l"
+        const val NSEC_ONE =
+            "nsec1qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsmhltgl"
+        const val PUBLIC_KEY_ONE =
+            "79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798"
+        const val NPUB_ONE =
+            "npub10xlxvlhemja6c4dqv22uapctqupfhlxm9h8z3k2e72q4k9hcz7vqpkge6d"
+        const val SECP256K1_ORDER =
+            "fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141"
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/signer/LocalSignerTest.kt

@@ -0,0 +1,110 @@
+package com.pakstr.app.signer
+
+import com.pakstr.app.crypto.Bip340Hash
+import com.pakstr.app.crypto.Nip46ClientKey
+import com.pakstr.app.crypto.NostrEventVerifier
+import kotlinx.coroutines.runBlocking
+import org.json.JSONArray
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertThrows
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class LocalSignerTest {
+    @Test
+    fun returns_same_public_key_after_key_reload() = runBlocking {
+        val privateKey = privateKey(3)
+        val expected =
+            Nip46ClientKey.fromPrivateKey(privateKey).use { key ->
+                key.publicKeyHex
+            }
+        val signer = signer(privateKey)
+
+        assertEquals(expected, signer.getPublicKey())
+        assertEquals(expected, signer.getPublicKey())
+    }
+
+    @Test
+    fun signs_event_with_valid_bip340_signature() = runBlocking {
+        val privateKey = privateKey(7)
+        val signer = signer(privateKey)
+        val signed = JSONObject(signer.signEvent(unsignedEvent().toString()))
+
+        assertEquals(signer.getPublicKey(), signed.getString("pubkey"))
+        assertEquals(64, signed.getString("id").length)
+        assertEquals(128, signed.getString("sig").length)
+        assertTrue(NostrEventVerifier.verify(signed))
+        assertFalse(signed.toString().contains(Bip340Hash.bytesToHex(privateKey)))
+    }
+
+    @Test
+    fun rejects_event_for_different_public_key() {
+        val signer = signer(privateKey(9))
+        val event =
+            unsignedEvent()
+                .put("pubkey", "a".repeat(64))
+
+        assertThrows(IllegalArgumentException::class.java) {
+            runBlocking {
+                signer.signEvent(event.toString())
+            }
+        }
+    }
+
+    @Test
+    fun nip44_round_trip_uses_local_key() = runBlocking {
+        val alice = signer(privateKey(11))
+        val bob = signer(privateKey(12))
+        val ciphertext =
+            alice.nip44Encrypt(
+                bob.getPublicKey(),
+                "local secret"
+            )
+
+        assertEquals(
+            "local secret",
+            bob.nip44Decrypt(
+                alice.getPublicKey(),
+                ciphertext
+            )
+        )
+    }
+
+    @Test
+    fun nip04_is_explicitly_unsupported() {
+        val signer = signer(privateKey(13))
+
+        assertThrows(UnsupportedOperationException::class.java) {
+            runBlocking {
+                signer.nip04Encrypt("a".repeat(64), "plaintext")
+            }
+        }
+        assertThrows(UnsupportedOperationException::class.java) {
+            runBlocking {
+                signer.nip04Decrypt("a".repeat(64), "ciphertext")
+            }
+        }
+    }
+
+    private fun signer(privateKey: ByteArray): LocalSigner {
+        return LocalSigner {
+            Nip46ClientKey.fromPrivateKey(privateKey)
+        }
+    }
+
+    private fun unsignedEvent(): JSONObject {
+        return JSONObject()
+            .put("created_at", 1_700_000_000)
+            .put("kind", 1)
+            .put("tags", JSONArray())
+            .put("content", "hello from local signer")
+    }
+
+    private fun privateKey(value: Int): ByteArray {
+        return ByteArray(32).also {
+            it[31] = value.toByte()
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pakstr",
-  "version": "0.27.0",
+  "version": "0.29.0",
   "description": "CLI for packaging Nostr web apps into Android APKs",
   "type": "commonjs",
   "main": "dist/index.js",
@@ -54,9 +54,9 @@
     "applesauce-core": "^6.2.0",
     "applesauce-signers": "^6.2.2",
     "fs-extra": "^11.3.6",
-    "js-yaml": "^5.3.0",
+    "js-yaml": "^5.4.1",
     "node-fetch": "^3.3.2",
-    "sharp": "^0.35.3",
+    "sharp": "^0.35.5",
     "unzipper": "^0.12.5"
   },
   "repository": {