From 64b0c786fb266f1536513f243702bc56f900e8de Mon Sep 17 00:00:00 2001 From: Jeffrey Aven Date: Sat, 3 Oct 2026 08:20:06 +1000 Subject: [PATCH] package updates --- .../stackql-provider-development/SKILL.md | 2 +- .../references/docs-and-ci.md | 2 +- .../references/handover.md | 1 + .../references/repo-layout-and-makefile.md | 2 +- .../references/uplift-checklist.md | 2 +- .github/workflows/build-and-test.yml | 6 +- .../workflows/prod-web-deploy.yml.disabled | 6 +- .../workflows/test-web-deploy.yml.disabled | 4 +- CLAUDE.md | 4 +- Makefile | 2 +- README.md | 8 +- SECURITY.md | 46 ++++++ bin/init-provider.sh | 2 +- package-lock.json | 139 ++++++++++++++---- package.json | 6 +- provider-dev/scripts/record_spec_pin.mjs | 5 +- website/package.json | 2 +- 17 files changed, 185 insertions(+), 54 deletions(-) create mode 100644 SECURITY.md diff --git a/.claude/skills/stackql-provider-development/SKILL.md b/.claude/skills/stackql-provider-development/SKILL.md index 1732d19..10c57c8 100644 --- a/.claude/skills/stackql-provider-development/SKILL.md +++ b/.claude/skills/stackql-provider-development/SKILL.md @@ -15,7 +15,7 @@ The detail lives in `references/`; `scripts/` holds two generic helpers: ## Ground rules - **Read before inventing.** Clone the reference repos ([references/reference-repos.md](references/reference-repos.md)) beside the provider repo and use `find_extension_examples.sh` to see a primitive shipped for real before authoring it. Sibling build repos carry NOTES.md findings - reuse them, do not re-derive. -- **Latest toolchain, always.** `npm view @stackql/provider-utils version`, `npm view @stackql/pgwire-lite version`, `npm view @docusaurus/core version` before starting; pin `^latest` in package.json. Node >= 20, `"type": "module"`. The lockfile pins what CI installs, so generation stays byte-for-byte reproducible; a toolchain bump is an explicit commit that regenerates the artifacts. +- **Latest toolchain, always.** `npm view @stackql/provider-utils version`, `npm view @stackql/pgwire-lite version`, `npm view @apidevtools/swagger-parser version`, `npm view @docusaurus/core version` before starting; pin `^latest` in package.json. Node >= 22.19 (Node 20 reached end of life in April 2026; swagger-parser 13 needs 22.19), `"type": "module"`. `js-yaml` stays on 4.x: provider-utils emits with js-yaml 4, and v5 drops the default export, removes the `quotingType` dump option and changes scalar quoting, so that bump is a coordinated change with provider-utils. The lockfile pins what CI installs, so generation stays byte-for-byte reproducible; a toolchain bump is an explicit commit that regenerates the artifacts. - **Deterministic pipeline.** Every step is a script that validates and fails without writing. Manual decisions are rules in scripts (mapping tables, skip codes, fix classes), never hand-edits to generated YAML or CSV. A regeneration reproduces the committed artifacts byte-for-byte (CI checks this). - **`all_services.csv` is the contract.** Committed and diffed on every regeneration; a method moving resource or a resource renamed is a breaking change to review, not noise. - **Environment.** Linux, macOS or WSL (on Windows prefer WSL and the latest `stackql` release on its PATH). GNU make + bash. `stackql` resolves as `$STACKQL`, `./stackql`, then PATH. diff --git a/.claude/skills/stackql-provider-development/references/docs-and-ci.md b/.claude/skills/stackql-provider-development/references/docs-and-ci.md index d6fe9bb..bdd93d6 100644 --- a/.claude/skills/stackql-provider-development/references/docs-and-ci.md +++ b/.claude/skills/stackql-provider-development/references/docs-and-ci.md @@ -18,4 +18,4 @@ The example section has one shape on every provider site, so the table of conten ## CI -`build-and-test.yml`: on push/PR - `npm ci`, `stackql/setup-stackql@v2`, `make fetch-spec` (warn on drift, build from the pin), build steps, **fail on uncommitted generation drift** (`git add -N . && git diff --quiet -- provider-dev/openapi provider-dev/config provider-dev/source`), `make test-offline test-integration test-meta`, `make docs`. A `smoke` job gated on secrets (skipped with a notice otherwise; never the expensive lifecycle). A weekly `spec-drift` job that fetches, compares with the pin, and opens a labelled issue with the diff stat. Web deploy workflows build the site from `main`. +`build-and-test.yml`: on push/PR - `actions/setup-node@v7` on Node 22, `npm ci`, `stackql/setup-stackql@v2`, `make fetch-spec` (warn on drift, build from the pin), build steps, **fail on uncommitted generation drift** (`git add -N . && git diff --quiet -- provider-dev/openapi provider-dev/config provider-dev/source`), `make test-offline test-integration test-meta`, `make docs`. A `smoke` job gated on secrets (skipped with a notice otherwise; never the expensive lifecycle). A weekly `spec-drift` job that fetches, compares with the pin, and opens a labelled issue with the diff stat. Web deploy workflows build the site from `main` with `yarn install --frozen-lockfile`, cached on `website/yarn.lock`; the first `make website` writes that lockfile, so commit it before enabling them. diff --git a/.claude/skills/stackql-provider-development/references/handover.md b/.claude/skills/stackql-provider-development/references/handover.md index e3333ce..7f03aa0 100644 --- a/.claude/skills/stackql-provider-development/references/handover.md +++ b/.claude/skills/stackql-provider-development/references/handover.md @@ -6,6 +6,7 @@ - **NOTES.md** - numbered findings with evidence (what was measured, against what, what was decided and why), a Blockers list of what only a live run can establish, and the testing requirements. It is the memory of the build; a future refresh reads it before touching a rule. - **README.md** - the numbered build guide (steps 0-8: pin, inventory, split, mappings, normalize, generate, test, publish, docs) with counts that match the committed artifacts, the Makefile targets, credentials, and the CI description. - **.env.example** - every live-test variable with a one-line comment; never a real value. +- **SECURITY.md** and **LICENSE** - carried from the template, placeholders rewritten by `bin/init-provider.sh`: the repository's private advisory form, the scope split between the provider and the engine, MIT. Not a build artifact; update only when the policy changes. ## Hand-over diff --git a/.claude/skills/stackql-provider-development/references/repo-layout-and-makefile.md b/.claude/skills/stackql-provider-development/references/repo-layout-and-makefile.md index 0febba9..65e0ef8 100644 --- a/.claude/skills/stackql-provider-development/references/repo-layout-and-makefile.md +++ b/.claude/skills/stackql-provider-development/references/repo-layout-and-makefile.md @@ -18,7 +18,7 @@ tests/ smoke_test.py website/ # Docusaurus microsite .github/workflows/ # build-and-test.yml, prod-web-deploy.yml, test-web-deploy.yml -CLAUDE.md NOTES.md README.md .env.example +CLAUDE.md NOTES.md README.md SECURITY.md LICENSE .env.example ``` Makefile targets (bash shell, `.DEFAULT_GOAL := help`, `##` help comments): `deps`, `fetch-spec` (verify pin), `refresh-spec` (`--update`), `inventory`, `split`, `mappings` (rm CSV + analyze + map), `pre-normalize`, `normalize`, `generate` (rm output + generate + post-process), `post-process`, `build` (the chain), `test-offline`, `test-integration`, `test-meta` (start server; run; stop; preserve exit status), `test`, `venv`, `smoke`, `smoke-live`, `smoke-read-only`, `smoke-`, `smoke-cleanup`, `docs`, `website`, `website-start`, `clean`, `all` = `deps build test docs website`. `make all` never needs credentials and never bills. The smoke targets source `.env` when present (`set -a; source <(tr -d '\r' < .env); set +a`). diff --git a/.claude/skills/stackql-provider-development/references/uplift-checklist.md b/.claude/skills/stackql-provider-development/references/uplift-checklist.md index 29b5ab2..e36069b 100644 --- a/.claude/skills/stackql-provider-development/references/uplift-checklist.md +++ b/.claude/skills/stackql-provider-development/references/uplift-checklist.md @@ -1,6 +1,6 @@ # Uplifting an existing provider -1. Bump `@stackql/provider-utils` / `@stackql/pgwire-lite` / Docusaurus to latest; `npm install`. +1. Bump `@stackql/provider-utils` / `@stackql/pgwire-lite` / `@apidevtools/swagger-parser` / Docusaurus to latest (`js-yaml` stays on 4.x - see the SKILL.md ground rules); Node >= 22.19 in `engines`, the Makefile header, the README prerequisites and every `setup-node` step; `npm install`. Add `SECURITY.md` and `LICENSE` from the template when absent. 2. `make fetch-spec`; if drift, review the diff, extend fix classes, `make refresh-spec`, record in NOTES.md. 3. Re-run the pipeline; diff `all_services.csv` - every moved method or renamed resource is a decision to make explicitly (keep the old name via a rule unless the rename is worth the break). 4. Add what is missing against this list: env-var scoping, naive bodies, snake surface, pagination, pushdown, transforms, objectKeys, lifecycle EXECs attached to their resources, views, GraphQL merge, skip codes for what is not mappable. diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index 814ddda..4cedccd 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -28,7 +28,7 @@ jobs: - uses: actions/setup-node@v7 with: - node-version: 20 + node-version: 22 cache: npm - name: Install dependencies @@ -115,7 +115,7 @@ jobs: - uses: actions/setup-node@v7 with: - node-version: 20 + node-version: 22 cache: npm - uses: actions/setup-python@v7 @@ -147,7 +147,7 @@ jobs: - uses: actions/setup-node@v7 with: - node-version: 20 + node-version: 22 cache: npm - name: Install dependencies diff --git a/.github/workflows/prod-web-deploy.yml.disabled b/.github/workflows/prod-web-deploy.yml.disabled index 7b950ed..f05212d 100644 --- a/.github/workflows/prod-web-deploy.yml.disabled +++ b/.github/workflows/prod-web-deploy.yml.disabled @@ -16,9 +16,11 @@ jobs: with: fetch-depth: 0 + # website/yarn.lock is written by the first `make website`; commit it + # before enabling this workflow (the install below is --frozen-lockfile). - uses: actions/setup-node@v7 with: - node-version: 20 + node-version: 22 cache: yarn cache-dependency-path: website/yarn.lock @@ -54,5 +56,3 @@ jobs: - name: Deploy to GitHub Pages id: deployment uses: actions/deploy-pages@v5 - with: - working-directory: website/build # Ensures the correct directory is used for deployment diff --git a/.github/workflows/test-web-deploy.yml.disabled b/.github/workflows/test-web-deploy.yml.disabled index 64df0d3..c64f2d3 100644 --- a/.github/workflows/test-web-deploy.yml.disabled +++ b/.github/workflows/test-web-deploy.yml.disabled @@ -16,9 +16,11 @@ jobs: with: fetch-depth: 0 + # website/yarn.lock is written by the first `make website`; commit it + # before enabling this workflow (the install below is --frozen-lockfile). - uses: actions/setup-node@v7 with: - node-version: 20 + node-version: 22 cache: yarn cache-dependency-path: website/yarn.lock diff --git a/CLAUDE.md b/CLAUDE.md index 22ce8b9..52c1d0a 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -33,7 +33,7 @@ TODO(template): one bullet each, as they are decided: ## Toolchain rules -- Latest `@stackql/provider-utils` and `@stackql/pgwire-lite` (check npm before starting: `npm view @stackql/provider-utils version`); Docusaurus `^3.10.x`. Node >= 20, `type: module`. `package-lock.json` pins what CI installs; a toolchain bump is an explicit commit that regenerates the artifacts. +- Latest `@stackql/provider-utils`, `@stackql/pgwire-lite` and `@apidevtools/swagger-parser` (check npm before starting: `npm view @stackql/provider-utils version`); Docusaurus `^3.10.x`. Node >= 22.19 (Node 20 reached end of life in April 2026; swagger-parser 13 needs 22.19), `type: module`. `js-yaml` stays on 4.x: provider-utils emits with js-yaml 4, and v5 drops the default export, removes the `quotingType` dump option and changes scalar quoting, so that bump is a coordinated change with provider-utils. `package-lock.json` pins what CI installs; a toolchain bump is an explicit commit that regenerates the artifacts. - Linux, macOS or WSL: GNU make + bash, a `stackql` binary (`$STACKQL`, `./stackql`, then PATH; `bin/start-server.sh` downloads one if none is found), Python 3 and yarn. The Makefile is the operator surface (`make help`). - The two provider-utils CLI entry points are npm scripts invoked through `node` (never `.bin` shims); flags go after `--`. @@ -62,7 +62,7 @@ tests/ website/ # Docusaurus microsite (shared stackql/docusaurus-config vendored at build) .github/workflows/ # build-and-test.yml (pin check, build, drift check, 3 test layers, gated smoke, # weekly spec-drift); web deploys (.disabled until GitHub Pages is configured) -CLAUDE.md NOTES.md README.md .env.example +CLAUDE.md NOTES.md README.md SECURITY.md LICENSE .env.example ``` ## Build pipeline diff --git a/Makefile b/Makefile index 80216fe..957fa5b 100644 --- a/Makefile +++ b/Makefile @@ -9,7 +9,7 @@ # `make all` never needs credentials and never bills; the live smoke targets # (`make smoke*`) are separate and source .env when present. # -# Requirements: Node >= 20, GNU make + bash, a stackql binary ($STACKQL, +# Requirements: Node >= 22.19, GNU make + bash, a stackql binary ($STACKQL, # ./stackql or on PATH - bin/start-server.sh downloads one if none is found), # Python 3 (a venv with pystackql is created on demand for the smoke suite), # yarn for the website. Runs on Linux, macOS or WSL. diff --git a/README.md b/README.md index ad76e3a..358b39f 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,7 @@ What the template is not: a publisher. Publishing to the public registry is a se ## Prerequisites -- Node.js >= 20 +- Node.js >= 22.19 - A `stackql` binary (`$STACKQL`, `./stackql`, or on `PATH`; `bin/start-server.sh` downloads one if none is found) - GNU make and bash (Linux, macOS or WSL); Python 3 for the smoke suite; yarn for the website - For live smoke tests: a dedicated dev account for the provider (never a production account) and its credentials in `.env` (see `.env.example`) @@ -172,6 +172,10 @@ A user can override at runtime with `stackql --auth='{"": {...}}'`. Contributions are welcome - rules in scripts, `make build && make test`, then a pull request. +## Security + +Report vulnerabilities privately through the repository's advisory form, never in a public issue - see [SECURITY.md](SECURITY.md). + ## License -MIT +MIT - see [LICENSE](LICENSE). diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..4dbde95 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,46 @@ +# Security Policy + +The StackQL team takes the security of the `myprovider` StackQL provider seriously. We appreciate everyone who reports vulnerabilities responsibly, and we will do our best to acknowledge and address valid reports promptly. + +## Reporting a Vulnerability + +Please do not open a public GitHub issue for security reports. A public issue discloses the problem before a fix is available and puts users at risk. + +Instead, report privately using GitHub private vulnerability reporting: + +1. Open the [new advisory form](https://github.com/stackql-registry/stackql-provider-myprovider/security/advisories/new) (Security tab -> Advisories -> "Report a vulnerability"). +2. Provide as much detail as you can: the provider version (`SHOW PROVIDERS` in a `stackql shell`, or the version directory under `provider-dev/openapi/src/myprovider/`), the resource and method involved, reproduction steps (the SQL statement and the request it produced, with credentials redacted), impact, and any suggested remediation. +3. Submit. This opens a private advisory thread visible only to you and the maintainers. + +If you cannot use GitHub private vulnerability reporting, email us at [info@stackql.io](mailto:info@stackql.io). Please put "SECURITY" in the subject line and treat the contents as confidential. + +## Supported Versions + +Security fixes are applied to the latest version of the provider published to the [StackQL provider registry](https://github.com/stackql/stackql-provider-registry); `REGISTRY PULL myprovider` installs it. Earlier published versions are supported on a best-effort basis only; we recommend pulling the latest version. + +## Response Expectations + +These are targets, not contractual guarantees: + +- We aim to acknowledge a report within a few business days. +- We will keep you updated as we investigate and work on a fix. +- We will coordinate disclosure timing with you once a fix or mitigation is ready. + +## Disclosure Policy + +We follow coordinated (responsible) disclosure. Please give us a reasonable opportunity to release a fix before any public disclosure. We are happy to credit reporters in the advisory and release notes, unless you prefer to remain anonymous. + +## Scope + +This policy covers what this repository produces and runs: the generated provider definition under `provider-dev/openapi/`, the build scripts under `provider-dev/scripts/` and `bin/`, the test harnesses under `tests/` (including the mock API server), the documentation site under `website/`, and the CI workflows. Reports in scope include a credential or token leaking into a generated document, a log, a docs page or a test fixture; a server template or request transform that sends a credential to a host other than the My Provider API; and a test harness that reaches a live account when it should not. + +Issues in the following belong elsewhere: + +- The `stackql` engine (SQL parsing, authentication handling, the HTTP client): [stackql/stackql](https://github.com/stackql/stackql/security/policy). +- The request-execution library: [stackql/any-sdk](https://github.com/stackql/any-sdk). +- The provider build tooling: [stackql-registry/stackql-provider-utils](https://github.com/stackql-registry/stackql-provider-utils). +- The My Provider API itself: the vendor's own security program. This provider describes that API; it does not operate it. + +## Credentials + +The provider reads credentials from environment variables at query time and does not store them. The live smoke suite reads them from `.env`, which is excluded from version control; never commit a real credential. If a credential is committed or published by mistake, rotate it first, then report the exposure as above. diff --git a/bin/init-provider.sh b/bin/init-provider.sh index 270f8b5..42cdb6e 100644 --- a/bin/init-provider.sh +++ b/bin/init-provider.sh @@ -35,7 +35,7 @@ REPO_ROOT="$( cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd )" cd "$REPO_ROOT" FILES=( - Makefile package.json package-lock.json README.md CLAUDE.md NOTES.md .env.example + Makefile package.json package-lock.json README.md CLAUDE.md NOTES.md SECURITY.md .env.example bin/fetch-spec.sh provider-dev/scripts/lib/spec_helpers.mjs provider-dev/scripts/record_spec_pin.mjs diff --git a/package-lock.json b/package-lock.json index d345c26..5039759 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,30 +9,52 @@ "version": "0.1.0", "license": "MIT", "dependencies": { - "@apidevtools/swagger-parser": "^12.1.0", + "@apidevtools/swagger-parser": "^13.1.0", "@stackql/pgwire-lite": "^1.0.2", - "@stackql/provider-utils": "^0.7.8", + "@stackql/provider-utils": "^0.7.10", "js-yaml": "^4.1.0", "pluralize": "^8.0.0" }, "engines": { - "node": ">=20.0.0" + "node": ">=22.19.0" } }, "node_modules/@apidevtools/json-schema-ref-parser": { - "version": "14.0.1", - "resolved": "https://registry.npmjs.org/@apidevtools/json-schema-ref-parser/-/json-schema-ref-parser-14.0.1.tgz", - "integrity": "sha512-Oc96zvmxx1fqoSEdUmfmvvb59/KDOnUoJ7s2t7bISyAn0XEz57LCCw8k2Y4Pf3mwKaZLMciESALORLgfe2frCw==", + "version": "16.0.3", + "resolved": "https://registry.npmjs.org/@apidevtools/json-schema-ref-parser/-/json-schema-ref-parser-16.0.3.tgz", + "integrity": "sha512-7lZp4XCTZhU/AgiGpIG+j4uJeWPdGbpQ+8wqXrzuHy+tboKsjSacjGH9/kNThRDIFhMWHF3ba+ejS8J3PeSI1Q==", "license": "MIT", "dependencies": { - "@types/json-schema": "^7.0.15", - "js-yaml": "^4.1.0" + "js-yaml": "^5.4.2", + "undici": "^8.10.2" }, "engines": { - "node": ">= 16" + "node": ">=22.19.0" }, - "funding": { - "url": "https://github.com/sponsors/philsturgeon" + "peerDependencies": { + "@types/json-schema": "^7.0.15" + } + }, + "node_modules/@apidevtools/json-schema-ref-parser/node_modules/js-yaml": { + "version": "5.4.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.2.tgz", + "integrity": "sha512-m+aqu+LwO1O6sIopafj8HUVl5aawITwZQe/yHpMCKjaWBaA/d07B/QdMb3529REftiU+RMMHL3Vlsw3hON7vWg==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", + "dependencies": { + "argparse": "^2.0.1" + }, + "bin": { + "js-yaml": "bin/js-yaml.mjs" } }, "node_modules/@apidevtools/openapi-schemas": { @@ -51,18 +73,22 @@ "license": "MIT" }, "node_modules/@apidevtools/swagger-parser": { - "version": "12.1.0", - "resolved": "https://registry.npmjs.org/@apidevtools/swagger-parser/-/swagger-parser-12.1.0.tgz", - "integrity": "sha512-e5mJoswsnAX0jG+J09xHFYQXb/bUc5S3pLpMxUuRUA2H8T2kni3yEoyz2R3Dltw5f4A6j6rPNMpWTK+iVDFlng==", + "version": "13.1.0", + "resolved": "https://registry.npmjs.org/@apidevtools/swagger-parser/-/swagger-parser-13.1.0.tgz", + "integrity": "sha512-dkCuqCWh5U7u0aurmmc/qvel2KeKDxHTwVtUdYonndIpD7mXV6AVaWNdvaja2HAy628z7FT/Qdz8sCgzwhgwKg==", "license": "MIT", "dependencies": { - "@apidevtools/json-schema-ref-parser": "14.0.1", + "@apidevtools/json-schema-ref-parser": "^16.0.3", "@apidevtools/openapi-schemas": "^2.1.0", "@apidevtools/swagger-methods": "^3.0.2", - "ajv": "^8.17.1", + "@types/json-schema": "^7.0.15", + "ajv": "^8.20.0", "ajv-draft-04": "^1.0.0", "call-me-maybe": "^1.0.2" }, + "engines": { + "node": ">=22.19.0" + }, "peerDependencies": { "openapi-types": ">=7" } @@ -93,6 +119,30 @@ "integrity": "sha512-4JQNk+3mVzK3xh2rqd6RB4J46qUR19azEHBneZyTZM+c456qOrbbM/5xcR8huNCCcbVt7+UmizG6GuUvPvKUYg==", "license": "MIT" }, + "node_modules/@jsep-plugin/assignment": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/@jsep-plugin/assignment/-/assignment-1.3.0.tgz", + "integrity": "sha512-VVgV+CXrhbMI3aSusQyclHkenWSAm95WaiKrMxRFam3JSUiIaQjoMIw2sEs/OX4XifnqeQUN4DYbJjlA8EfktQ==", + "license": "MIT", + "engines": { + "node": ">= 10.16.0" + }, + "peerDependencies": { + "jsep": "^0.4.0||^1.0.0" + } + }, + "node_modules/@jsep-plugin/regex": { + "version": "1.0.4", + "resolved": "https://registry.npmjs.org/@jsep-plugin/regex/-/regex-1.0.4.tgz", + "integrity": "sha512-q7qL4Mgjs1vByCaTnDFcBnV9HS7GVPJX5vyVoCgZHNSC9rjwIlmbXG5sUuorR5ndfHAIlJ8pVStxvjXHbNvtUg==", + "license": "MIT", + "engines": { + "node": ">= 10.16.0" + }, + "peerDependencies": { + "jsep": "^0.4.0||^1.0.0" + } + }, "node_modules/@so-ric/colorspace": { "version": "1.1.6", "resolved": "https://registry.npmjs.org/@so-ric/colorspace/-/colorspace-1.1.6.tgz", @@ -105,11 +155,11 @@ }, "node_modules/@stackql/deno-openapi-dereferencer": { "name": "@jsr/stackql__deno-openapi-dereferencer", - "version": "0.3.1", - "resolved": "https://npm.jsr.io/~/11/@jsr/stackql__deno-openapi-dereferencer/0.3.1.tgz", - "integrity": "sha512-7Ucdom3SYxvzp7VwzulQMe66E+1LeCZIprFQ70PwRPIUfL90bYNQDrLfe5L1WaB+X7StWdHmoFSFxoa9RDlN7w==", + "version": "0.3.2", + "resolved": "https://npm.jsr.io/~/11/@jsr/stackql__deno-openapi-dereferencer/0.3.2.tgz", + "integrity": "sha512-Qj5B0pl2Rsec+GHwGGIh9254AQfEplkD82HW9FEhQR+vZvzhEgF2Ap72hmdLq8rWOGV4soSnQ4sFYorE2pIT5Q==", "dependencies": { - "jsonpath-plus": "7.0.0" + "jsonpath-plus": "^10.3.0" } }, "node_modules/@stackql/pgwire-lite": { @@ -122,13 +172,13 @@ } }, "node_modules/@stackql/provider-utils": { - "version": "0.7.8", - "resolved": "https://registry.npmjs.org/@stackql/provider-utils/-/provider-utils-0.7.8.tgz", - "integrity": "sha512-eJJ27ceMo+eTT4OTuJ7e0Cvft21u+SSGh+2s3THeoDxImndiNlg4W0wd4Sv7k+5ZbhDDbcIKcka6RJFZybkVCw==", + "version": "0.7.10", + "resolved": "https://registry.npmjs.org/@stackql/provider-utils/-/provider-utils-0.7.10.tgz", + "integrity": "sha512-3hlaKT2ce8IaFx0E99ksW0uvmBcQgtfzWAAJz24oSM7bX++6ZrLe87j6CAUyRszowP4FLaO6UMOlHNQzibnViw==", "license": "MIT", "dependencies": { "@apidevtools/swagger-parser": "^10.1.1", - "@stackql/deno-openapi-dereferencer": "npm:@jsr/stackql__deno-openapi-dereferencer@^0.3.1", + "@stackql/deno-openapi-dereferencer": "npm:@jsr/stackql__deno-openapi-dereferencer@^0.3.2", "csv-parser": "^3.2.0", "js-yaml": "^4.1.0", "pluralize": "^8.0.0" @@ -307,9 +357,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.6", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.6.tgz", - "integrity": "sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==", + "version": "3.1.8", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz", + "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==", "funding": [ { "type": "github", @@ -374,6 +424,15 @@ "js-yaml": "bin/js-yaml.js" } }, + "node_modules/jsep": { + "version": "1.4.0", + "resolved": "https://registry.npmjs.org/jsep/-/jsep-1.4.0.tgz", + "integrity": "sha512-B7qPcEVE3NVkmSJbaYxvv4cHkVW7DQsZz13pUMrfS8z8Q/BuShN+gcTXrUlPiGqM2/t/EEaI030bpxMqY8gMlw==", + "license": "MIT", + "engines": { + "node": ">= 10.16.0" + } + }, "node_modules/json-schema-traverse": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz", @@ -381,12 +440,21 @@ "license": "MIT" }, "node_modules/jsonpath-plus": { - "version": "7.0.0", - "resolved": "https://registry.npmjs.org/jsonpath-plus/-/jsonpath-plus-7.0.0.tgz", - "integrity": "sha512-MH4UnrWrU1hJGVEyEyjvYgONkzNTO6Yol0nq18EMnUQ/ZC5cTuJheirXXIwu1b9mZ6t3XL0P79gPsu+zlTnDIQ==", + "version": "10.4.0", + "resolved": "https://registry.npmjs.org/jsonpath-plus/-/jsonpath-plus-10.4.0.tgz", + "integrity": "sha512-T92WWatJXmhBbKsgH/0hl+jxjdXrifi5IKeMY02DWggRxX0UElcbVzPlmgLTbvsPeW1PasQ6xE2Q75stkhGbsA==", "license": "MIT", + "dependencies": { + "@jsep-plugin/assignment": "^1.3.0", + "@jsep-plugin/regex": "^1.0.4", + "jsep": "^1.4.0" + }, + "bin": { + "jsonpath": "bin/jsonpath-cli.js", + "jsonpath-plus": "bin/jsonpath-cli.js" + }, "engines": { - "node": ">=12.0.0" + "node": ">=18.0.0" } }, "node_modules/kuler": { @@ -528,6 +596,15 @@ "node": ">= 14.0.0" } }, + "node_modules/undici": { + "version": "8.11.2", + "resolved": "https://registry.npmjs.org/undici/-/undici-8.11.2.tgz", + "integrity": "sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==", + "license": "MIT", + "engines": { + "node": ">=22.19.0" + } + }, "node_modules/util-deprecate": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz", diff --git a/package.json b/package.json index fa3d7c9..a631d9d 100644 --- a/package.json +++ b/package.json @@ -25,9 +25,9 @@ "probe": "node ./tests/integration/probe.mjs" }, "dependencies": { - "@apidevtools/swagger-parser": "^12.1.0", + "@apidevtools/swagger-parser": "^13.1.0", "@stackql/pgwire-lite": "^1.0.2", - "@stackql/provider-utils": "^0.7.8", + "@stackql/provider-utils": "^0.7.10", "js-yaml": "^4.1.0", "pluralize": "^8.0.0" }, @@ -37,7 +37,7 @@ "provider" ], "engines": { - "node": ">=20.0.0" + "node": ">=22.19.0" }, "license": "MIT" } diff --git a/provider-dev/scripts/record_spec_pin.mjs b/provider-dev/scripts/record_spec_pin.mjs index 7accb96..ca7815c 100644 --- a/provider-dev/scripts/record_spec_pin.mjs +++ b/provider-dev/scripts/record_spec_pin.mjs @@ -106,8 +106,9 @@ const FIX_CLASSES = [ { name: 'const_to_enum', apply: (doc) => { let n = 0; walk(doc, (o) => { if ('const' in o && !('enum' in o)) { o.enum = [o.const]; delete o.const; n++; } }); return n; } }, { name: 'hide_definitions_removed', apply: (doc) => { let n = 0; walk(doc, (o) => { if ('hideDefinitions' in o) { delete o.hideDefinitions; n++; } }); return n; } }, { - // swagger-parser v12 accepts 3.1.0 / 3.1.1 but rejects the errata-only - // 3.1.2 by string match; the document semantics are unchanged. + // swagger-parser 12 rejected the errata-only 3.1.2 by string match; 13 + // accepts it. Kept so a snapshot's declared version does not move on a + // toolchain bump; the document semantics are unchanged. name: 'openapi_3_1_2_to_3_1_1', apply: (doc) => { if (doc.openapi === '3.1.2') { doc.openapi = '3.1.1'; return 1; } return 0; } } diff --git a/website/package.json b/website/package.json index 3c098a2..7f17b06 100644 --- a/website/package.json +++ b/website/package.json @@ -67,7 +67,7 @@ ] }, "engines": { - "node": ">=20.0" + "node": ">=22.19" }, "license": "MIT" }