diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000000..c40c8286324 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,42 @@ +# t3x fork Dependabot config. Upstream has no `.github/dependabot.yml`, so this file is +# fork-owned and costs no seam-ledger row. +# +# It configures NO version updates. Its only job is to stop Dependabot opening *security* +# update PRs against the vendored reference subtrees under `.repos/`. +# +# `.repos/effect-smol` and `.repos/alchemy-effect` are `git subtree`s of other projects, +# maintained by `scripts/sync-reference-repos.ts` (added upstream in #2902 / #2918). They are +# reference source for agents to read, not code this fork runs: +# +# - no glob in `pnpm-workspace.yaml` matches them, so nothing there is ever installed, +# bundled or shipped — an advisory inside them is not reachable from any artifact we build; +# - `ci.yml` sparse-checks-out `!/.repos/`, so the code is not even present when CI runs; +# - a fork-local edit inside a subtree diverges it from its source, so the next +# `subtree pull` conflicts — in a ~30k-line lockfile — and the same hunk is re-conflicted +# on every daily rebase onto upstream. +# +# They were nonetheless 41 of the fork's 107 open Dependabot alerts, and each alert can spawn a +# PR: #48 (undici) and #50 (hono) were both closed unmerged for the reasons above. +# +# Two details that make this work, both easy to get wrong: +# +# - Per GitHub's docs, a config entry applies to security updates only when `directory` / +# `directories` matches the *manifest* locations and no `target-branch` is set. The +# manifests here are nested deep (`.repos/effect-smol/packages/platform-node/package.json`, +# `.repos/alchemy-effect/packages/alchemy/test/.../react-router-rsc-fixture/package.json`), +# hence the `**` globs rather than the two subtree roots. +# - `open-pull-requests-limit: 0` alone would NOT do this. It is documented as +# version-updates-only, and security PRs are explicitly exempt from that limit. The +# wildcard `ignore` is the lever that reaches security updates; the limit is belt-and-braces +# against the `schedule` key below (required by the schema) enabling version updates. +version: 2 +updates: + - package-ecosystem: npm + directories: + - "/.repos/*" + - "/.repos/**" + schedule: + interval: monthly + open-pull-requests-limit: 0 + ignore: + - dependency-name: "*" diff --git a/apps/desktop/package.json b/apps/desktop/package.json index 1526965427f..44bbb9d5e4f 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -21,7 +21,7 @@ "@t3tools/ssh": "workspace:*", "@t3tools/tailscale": "workspace:*", "effect": "catalog:", - "electron": "41.5.0", + "electron": "41.10.3", "electron-store": "^8.2.0", "electron-updater": "^6.6.2", "playwright-core": "1.60.0", diff --git a/docs/t3x/SEAMS.md b/docs/t3x/SEAMS.md index 123602d26ea..51df501a091 100644 --- a/docs/t3x/SEAMS.md +++ b/docs/t3x/SEAMS.md @@ -2,7 +2,7 @@ **The authoritative list of every upstream-owned file this fork edits.** -Measured, not asserted: **35 upstream-owned files, +1700 / -187 lines**, against merge-base +Measured, not asserted: **36 upstream-owned files, +1733 / -257 lines**, against merge-base `64bf01619` (the 2026-08-02 upstream sync). Everything else the fork adds lives in new files upstream has never seen and cannot conflict. @@ -54,6 +54,12 @@ recurring rebase conflict in a file this doc said the fork did not touch) went u > **Tripwire:** the surface is already far past "a handful of rows". Before adding row 36, re-isolate > something instead. Prefer fork-owned files even when an in-place edit is smaller. > +> Row 36 (`apps/desktop/package.json`) was added on 2026-08-08 for an electron security pin. It is +> the one shape the tripwire cannot redirect: a dependency version has no fork-owned home, and the +> only alternative — a pnpm `overrides` entry — sits in `pnpm-workspace.yaml`, an upstream file, for +> the same cost and worse legibility. It is a single version string and it retires itself as soon as +> upstream passes `41.10.3`. +> > Row 35 (`AGENTS.md`) was added knowingly on 2026-08-05, against this tripwire. The alternatives — > a tracked `.claude/settings.json` SessionStart hook, or an untracked `CLAUDE.local.md` — were > rejected for being Claude-Code-only and worktree-local respectively. It is six lines of prose in a @@ -77,8 +83,8 @@ Sorted by risk, worst first. | Upstream file | fork Δ | churn | risk | Why the fork touches it | | ----------------------------------------------------------------------- | -------- | ----- | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `pnpm-lock.yaml` | +125/-69 | 64 | **12416** | Web Push adds `web-push` + `@types/web-push`; update delivery adds the `t3x-update-relay` workspace entry (+6, `effect` + `@cloudflare/workers-types` only — `wrangler` is run via `pnpm dlx` precisely to keep it out of here, it would have cost ~500); the electron 41.10.3 security bump re-resolves the electron tree (+32/-69, a net **shrink** — `@electron/get` 2.0.3 + 3.1.0 collapse into 5.1.0). Unavoidable and always conflicts; regenerate rather than merge | | `apps/web/src/components/ChatView.tsx` | +181/-1 | 63 | **11466** | Thread outbox: `handleQueueComposerSubmission`, queue-mode state, `onSend` early-return, ``, `sendLabel`, steer-vs-queue predicate, dispatch breadcrumb | -| `pnpm-lock.yaml` | +93 | 64 | **5952** | Web Push adds `web-push` + `@types/web-push`; update delivery adds the `t3x-update-relay` workspace entry (+6, `effect` + `@cloudflare/workers-types` only — `wrangler` is run via `pnpm dlx` precisely to keep it out of here, it would have cost ~500). Unavoidable and always conflicts; regenerate rather than merge | | `packages/client-runtime/src/connection/supervisor.test.ts` | +363 | 5 | **1815** | Issue #21: 356-line appended `describe` + harness plumbing | | `packages/client-runtime/src/connection/supervisor.ts` | +186/-63 | 5 | **1245** | Issue #21: in-place rewrite of the reconnect/backoff state machine; now also owns the shared `runLivenessProbe` helper upstream's probe path uses | | `apps/web/src/components/settings/SettingsPanels.tsx` | +58 | 18 | **1044** | Needs-input notifications: import, 3 restore-reducer entries, permission state, a 45-line ``. **Not registered in upstream's new settings-search catalog** — see the note below the table | @@ -105,6 +111,7 @@ Sorted by risk, worst first. | `AGENTS.md` | +6 | 10 | **60** | `## Agent skills` pointer block for the mattpocock engineering skills. Three one-line links into `docs/t3x/agents/`; no config lives here. Placed between `## How it works` and `## Where code lives` — stable anchors, deliberately not appended at EOF where upstream adds tips (the issue #29 add/add pattern) | | `apps/web/src/connection/platform.ts` | +7/-1 | 7 | **56** | Lazy `import()` of outbox cleanup to dodge a module-init cycle | | `apps/mobile/…/T3ComposerEditorView.kt` | +51 | 1 | **51** | Android bare-Enter intercept | +| `apps/desktop/package.json` | +1/-1 | 15 | **30** | **Row 36, added 2026-08-08 against the tripwire below.** `electron` pinned to `41.10.3`, not upstream's `41.5.0`, for GHSA advisories #94 (high: sandboxed iframe bypasses `allow-popups` via OpenURL) and #92 (medium: `ProtocolResponse.url` reuses the default session cache). Upstream is still on `41.5.0`, so the sync does **not** carry this fix and the fork ships its own desktop builds. There is no fork-owned way to pin a dependency — an `overrides` entry would land in `pnpm-workspace.yaml`, another upstream file, for the same cost. Retire this row the moment upstream passes `41.10.3`: take upstream's side of the conflict | | `apps/server/package.json` | +2 | 15 | **30** | `web-push` dependency | | `apps/mobile/src/native/T3ComposerEditor.types.ts` | +5/-1 | 3 | **18** | Reworded `onSubmit` doc comment | | `apps/desktop/src/settings/DesktopClientSettings.test.ts` | +1 | 7 | **7** | `notifyOnNeedsInput` in a fixture | diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index c2635917de6..40fe97dcc76 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -112,7 +112,7 @@ importers: dependencies: '@clerk/electron': specifier: 0.0.24 - version: 0.0.24(@clerk/electron-passkeys@0.0.3)(electron-store@8.2.0)(electron@41.5.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6) + version: 0.0.24(@clerk/electron-passkeys@0.0.3)(electron-store@8.2.0)(electron@41.10.3)(react-dom@19.2.6(react@19.2.6))(react@19.2.6) '@clerk/electron-passkeys': specifier: 0.0.3 version: 0.0.3 @@ -138,8 +138,8 @@ importers: specifier: 4.0.0-beta.102 version: 4.0.0-beta.102(patch_hash=71215759e1ac0a7f65d7b75d816986687ae6c3a6cba02d928d184ca71790d488) electron: - specifier: 41.5.0 - version: 41.5.0 + specifier: 41.10.3 + version: 41.10.3 electron-store: specifier: ^8.2.0 version: 8.2.0 @@ -521,7 +521,7 @@ importers: version: 1.5.0(@types/react@19.2.16)(react-dom@19.2.6(react@19.2.6))(react@19.2.6) '@clerk/electron': specifier: 0.0.24 - version: 0.0.24(@clerk/electron-passkeys@0.0.3)(electron-store@8.2.0)(electron@41.5.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6) + version: 0.0.24(@clerk/electron-passkeys@0.0.3)(electron-store@8.2.0)(electron@41.10.3)(react-dom@19.2.6(react@19.2.6))(react@19.2.6) '@clerk/react': specifier: 6.12.9 version: 6.12.9(react-dom@19.2.6(react@19.2.6))(react@19.2.6) @@ -2052,6 +2052,10 @@ packages: resolution: {integrity: sha512-XQsZgjm2EcVUiZQf11UBJQfmZeEmOW8DpI1gsFeln6w0ae0ii4dMQEQ0kjl6DspdWX1aGY1/loyXnP0JS06e/A==} engines: {node: '>=0.8.0'} + '@electron-internal/extract-zip@1.0.5': + resolution: {integrity: sha512-+bqFCP98pLI0Tt0XQo1TmlXtwjWchISndDOxCkEcIuUgXWpBnLyRI+2DU+mesvnMMX6L1XDqYNA0lXNDHd/yiA==} + engines: {node: '>=22.12.0'} + '@electron/asar@3.4.1': resolution: {integrity: sha512-i4/rNPRS84t0vSRa2HorerGRXWyF4vThfHesw0dmcWHp+cspK743UanA0suA5Q5y8kzY2y6YKrvbIUn69BCAiA==} engines: {node: '>=10.12.0'} @@ -2061,14 +2065,14 @@ packages: resolution: {integrity: sha512-zx0EIq78WlY/lBb1uXlziZmDZI4ubcCXIMJ4uGjXzZW0nS19TjSPeXPAjzzTmKQlJUZm0SbmZhPKP7tuQ1SsEw==} hasBin: true - '@electron/get@2.0.3': - resolution: {integrity: sha512-Qkzpg2s9GnVV2I2BjRksUi43U5e6+zaQMcjoJy0C+C5oxaKl+fmckGDQFtRpZpZV0NQekuZZ+tGz7EA9TVnQtQ==} - engines: {node: '>=12'} - '@electron/get@3.1.0': resolution: {integrity: sha512-F+nKc0xW+kVbBRhFzaMgPy3KwmuNTYX1fx6+FxxoSnNgwYX6LD7AKBTWkU0MQ6IBoe7dz069CNkR673sPAgkCQ==} engines: {node: '>=14'} + '@electron/get@5.1.0': + resolution: {integrity: sha512-3kSBtG8ObcTVfXanm5vVJ6UnBLEVmVsRk1M+vGqCuMBV+XLCbJYuWQful+yIy0GQDsSlK0kHEriEHn7SPk4EnA==} + engines: {node: '>=22.12.0'} + '@electron/notarize@2.5.0': resolution: {integrity: sha512-jNT8nwH1f9X5GEITXaQ8IF/KdskvIkOFfB2CvwumsveVidzpSc+mvhhTMdAGSYF3O+Nq49lJ7y+ssODRXu06+A==} engines: {node: '>= 10.0.0'} @@ -4914,9 +4918,6 @@ packages: '@types/yargs@17.0.35': resolution: {integrity: sha512-qUHkeCyQFxMXg79wQfTtfndEC+N9ZZg76HJftDJp+qH2tV7Gj4OJi7l+PiWwJ+pWtW8GwSmqsDj/oymhrTWXjg==} - '@types/yauzl@2.10.3': - resolution: {integrity: sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q==} - '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260604.1': resolution: {integrity: sha512-zs616um9UuaODLsNlCu5Aw95rFcTV4u3hVt090r6k0lVvTxfaJOv8HKA6BpIotcEYlZlMQowrMSYCCdedo7iyA==} engines: {node: '>=16.20.0'} @@ -5646,9 +5647,6 @@ packages: resolution: {integrity: sha512-WIsKqkSC0ABoBJuT1LEX+2HEvNmNKKgnTAyd0fL8qzK4SH2i9NXg+t08YtdZp/V9IZ33cxe3iV4yM0qg8lMQng==} engines: {node: '>=16.20.1'} - buffer-crc32@0.2.13: - resolution: {integrity: sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==} - buffer-equal-constant-time@1.0.1: resolution: {integrity: sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==} @@ -6375,9 +6373,9 @@ packages: resolution: {integrity: sha512-bO3y10YikuUwUuDUQRM4KfwNkKhnpVO7IPdbsrejwN9/AABJzzTQ4GeHwyzNSrVO+tEH3/Np255a3sVZpZDjvg==} engines: {node: '>=8.0.0'} - electron@41.5.0: - resolution: {integrity: sha512-x9j9//PubUA4EjDtQbZhtk3prolandqCKgit0uCIqc1jb8FTskPbnJtxcDFB1aejczJcuERgjPixBUaMwoWyJg==} - engines: {node: '>= 12.20.55'} + electron@41.10.3: + resolution: {integrity: sha512-MJuSODPw8siv/I8JjhctW/cS/XNldwI4gLRyyWZx6QkoZJUDgbEvitp7IVOnGrHENTQb6Udo+zMpKhFnhlIhdg==} + engines: {node: '>= 22.12.0'} hasBin: true emmet@2.4.11: @@ -6416,6 +6414,10 @@ packages: resolution: {integrity: sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==} engines: {node: '>=6'} + env-paths@3.0.0: + resolution: {integrity: sha512-dtJUTepzMW3Lm/NPxRf3wP4642UWhjL2sQxc+ym2YMj1m/H2zDNQOlezafzkHwn6sMstjHTwG6iQQsctDW/b1A==} + engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0} + environment@1.1.0: resolution: {integrity: sha512-xUtoPkMggbz0MPyPiIWr1Kp4aeWJjDZ6SMvURhimjdZgsRuDplF5/s9hcgGhyXMhs+6vpnuoiZ2kFiu3FMnS8Q==} engines: {node: '>=18'} @@ -6853,11 +6855,6 @@ packages: extend@3.0.2: resolution: {integrity: sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==} - extract-zip@2.0.1: - resolution: {integrity: sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg==} - engines: {node: '>= 10.17.0'} - hasBin: true - fast-check@4.9.0: resolution: {integrity: sha512-7ms6T7SybUev/PQITciI0yLM2pOSFy5zpG8Ty7tQofcVaQUvrMXp6CBwqF6fThLCLOrfBtuHAtwq6Yu4XPCllg==} engines: {node: '>=12.17.0'} @@ -6916,9 +6913,6 @@ packages: fb-watchman@2.0.2: resolution: {integrity: sha512-p5161BqbuCaSnB8jIbzQHOlpgsPmK5rJVDfDKO91Axs5NC1uu3HRQm6wt9cd9/+GtQQIO53JdGXXoyDpTAsgYA==} - fd-slicer@1.1.0: - resolution: {integrity: sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==} - fdir@6.5.0: resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==} engines: {node: '>=12.0.0'} @@ -8648,9 +8642,6 @@ packages: resolution: {integrity: sha512-eRWB5LBz7PpDu4PUlwT0PhnQfTQJlDDdPa35urV4Osrm0t0AqQFGn+UIkU3klZvwJ8KPO3VbBFsXquA6p6kqZw==} engines: {node: '>=12', npm: '>=6'} - pend@1.2.0: - resolution: {integrity: sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==} - pg-cloudflare@1.4.0: resolution: {integrity: sha512-Vo7z/6rrQYxpNRylp4Tlob2elzbh+N/MOQbxFVWCxS7oEx6jF53GTJFxK2WWpKuBRkmiin4Mt+xofFDjx09R0A==} @@ -10483,9 +10474,6 @@ packages: resolution: {integrity: sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==} engines: {node: '>=12'} - yauzl@2.10.0: - resolution: {integrity: sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==} - yjs@13.6.31: resolution: {integrity: sha512-Eq+5BRfbeGyqGVrTJL3bEcr8gKkxPuyuoHmAwpk52fDb8kOVMrfVSTRPd6yiGgX5Fskb96qCRjzjbRjrL4YEnw==} engines: {node: '>=16.0.0', npm: '>=8.0.0'} @@ -11611,12 +11599,12 @@ snapshots: '@clerk/electron-passkeys-win32-arm64-msvc': 0.0.3 '@clerk/electron-passkeys-win32-x64-msvc': 0.0.3 - '@clerk/electron@0.0.24(@clerk/electron-passkeys@0.0.3)(electron-store@8.2.0)(electron@41.5.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)': + '@clerk/electron@0.0.24(@clerk/electron-passkeys@0.0.3)(electron-store@8.2.0)(electron@41.10.3)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)': dependencies: '@clerk/clerk-js': 6.25.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6) '@clerk/react': 6.12.9(react-dom@19.2.6(react@19.2.6))(react@19.2.6) '@clerk/shared': 4.25.9(react-dom@19.2.6(react@19.2.6))(react@19.2.6) - electron: 41.5.0 + electron: 41.10.3 react: 19.2.6 tslib: 2.8.1 optionalDependencies: @@ -11920,6 +11908,8 @@ snapshots: dependencies: '@types/hammerjs': 2.0.46 + '@electron-internal/extract-zip@1.0.5': {} + '@electron/asar@3.4.1': dependencies: commander: 5.1.0 @@ -11932,7 +11922,7 @@ snapshots: fs-extra: 9.1.0 minimist: 1.2.8 - '@electron/get@2.0.3': + '@electron/get@3.1.0': dependencies: debug: 4.4.3 env-paths: 2.2.1 @@ -11946,17 +11936,16 @@ snapshots: transitivePeerDependencies: - supports-color - '@electron/get@3.1.0': + '@electron/get@5.1.0': dependencies: debug: 4.4.3 - env-paths: 2.2.1 - fs-extra: 8.1.0 - got: 11.8.6 + env-paths: 3.0.0 + graceful-fs: 4.2.11 progress: 2.0.3 - semver: 6.3.1 + semver: 7.8.5 sumchecker: 3.0.1 optionalDependencies: - global-agent: 3.0.0 + undici: 7.27.1 transitivePeerDependencies: - supports-color @@ -15100,11 +15089,6 @@ snapshots: dependencies: '@types/yargs-parser': 21.0.3 - '@types/yauzl@2.10.3': - dependencies: - '@types/node': 24.12.4 - optional: true - '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260604.1': optional: true @@ -15990,8 +15974,6 @@ snapshots: bson@6.10.4: {} - buffer-crc32@0.2.13: {} - buffer-equal-constant-time@1.0.1: {} buffer-from@1.1.2: {} @@ -16623,11 +16605,11 @@ snapshots: transitivePeerDependencies: - supports-color - electron@41.5.0: + electron@41.10.3: dependencies: - '@electron/get': 2.0.3 + '@electron-internal/extract-zip': 1.0.5 + '@electron/get': 5.1.0 '@types/node': 24.12.4 - extract-zip: 2.0.1 transitivePeerDependencies: - supports-color @@ -16659,6 +16641,8 @@ snapshots: env-paths@2.2.1: {} + env-paths@3.0.0: {} + environment@1.1.0: {} err-code@2.0.3: {} @@ -17419,16 +17403,6 @@ snapshots: extend@3.0.2: {} - extract-zip@2.0.1: - dependencies: - debug: 4.4.3 - get-stream: 5.2.0 - yauzl: 2.10.0 - optionalDependencies: - '@types/yauzl': 2.10.3 - transitivePeerDependencies: - - supports-color - fast-check@4.9.0: dependencies: pure-rand: 8.4.0 @@ -17494,10 +17468,6 @@ snapshots: dependencies: bser: 2.1.1 - fd-slicer@1.1.0: - dependencies: - pend: 1.2.0 - fdir@6.5.0(picomatch@4.0.4): optionalDependencies: picomatch: 4.0.4 @@ -19565,8 +19535,6 @@ snapshots: pe-library@0.4.1: {} - pend@1.2.0: {} - pg-cloudflare@1.4.0: optional: true @@ -21772,11 +21740,6 @@ snapshots: y18n: 5.0.8 yargs-parser: 21.1.1 - yauzl@2.10.0: - dependencies: - buffer-crc32: 0.2.13 - fd-slicer: 1.1.0 - yjs@13.6.31: dependencies: lib0: 0.2.117