Merge pull request #80 from trails-cool/security-hardening-verification

2026-03-25 23:34:14 +00:00 · 2026-03-25 23:34:14 +00:00 · 589cb4ab15
commit 589cb4ab15
parent 433886772f b6908fb288
10 changed files with 604 additions and 28 deletions
--- a/openspec/changes/archive/2026-03-26-security-hardening/.openspec.yaml
+++ b/openspec/changes/archive/2026-03-26-security-hardening/.openspec.yaml
--- a/openspec/changes/archive/2026-03-26-security-hardening/design.md
+++ b/openspec/changes/archive/2026-03-26-security-hardening/design.md
--- a/openspec/changes/archive/2026-03-26-security-hardening/proposal.md
+++ b/openspec/changes/archive/2026-03-26-security-hardening/proposal.md
--- a/openspec/changes/archive/2026-03-26-security-hardening/specs/infrastructure/spec.md
+++ b/openspec/changes/archive/2026-03-26-security-hardening/specs/infrastructure/spec.md
--- a/openspec/changes/archive/2026-03-26-security-hardening/specs/security-hardening/spec.md
+++ b/openspec/changes/archive/2026-03-26-security-hardening/specs/security-hardening/spec.md
--- a/openspec/changes/archive/2026-03-26-security-hardening/tasks.md
+++ b/openspec/changes/archive/2026-03-26-security-hardening/tasks.md
@ -2,32 +2,32 @@

 - [x] 1.1 Add security headers block to Caddyfile: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy
 - [x] 1.2 Add Content-Security-Policy header (permissive initial policy allowing React Router inline scripts, OSM tiles, Sentry, WebSocket)
- [ ] 1.3 Test headers with securityheaders.com or curl after deploy
+- [x] 1.3 Test headers with securityheaders.com or curl after deploy

 ## 2. Scanner Blocking

 - [x] 2.1 Add Caddy path matcher for common scanner targets (.env*, .git*, wp-*, admin*, config.*, backup*)
 - [x] 2.2 Return 403 for matched paths before reverse_proxy
- [ ] 2.3 Verify scanner paths return 403, normal paths still work
+- [x] 2.3 Verify scanner paths return 403, normal paths still work

 ## 3. CI Secret Scanning

 - [x] 3.1 Add gitleaks/gitleaks-action@v2 step to CI workflow
 - [x] 3.2 Create .gitleaks.toml with allowlist for Sentry DSNs (public values)
- [ ] 3.3 Verify gitleaks passes on current codebase
+- [x] 3.3 Verify gitleaks passes on current codebase

 ## 4. Dependency Auditing

 - [x] 4.1 Add `pnpm audit --audit-level=high` step to CI workflow
 - [x] 4.2 Create .github/dependabot.yml for weekly pnpm dependency updates
- [ ] 4.3 Verify pnpm audit passes on current codebase
+- [x] 4.3 Verify pnpm audit passes on current codebase

 ## 5. Docker Hardening

 - [x] 5.1 Add non-root user to Journal Dockerfile runtime stage
 - [x] 5.2 Add non-root user to Planner Dockerfile runtime stage
 - [x] 5.3 Add non-root user to BRouter Dockerfile
- [ ] 5.4 Test containers start and serve correctly as non-root
+- [x] 5.4 Test containers start and serve correctly as non-root

 ## 6. Server Hardening

@ -42,7 +42,7 @@

 ## 8. Verify

- [ ] 8.1 Run securityheaders.com scan on trails.cool and planner.trails.cool
- [ ] 8.2 Verify scanner paths return 403 in production
- [ ] 8.3 Verify CI passes with all new scanning steps
- [ ] 8.4 Verify Docker containers run as non-root
+- [x] 8.1 Run securityheaders.com scan on trails.cool and planner.trails.cool
+- [x] 8.2 Verify scanner paths return 403 in production
+- [x] 8.3 Verify CI passes with all new scanning steps
+- [x] 8.4 Verify Docker containers run as non-root
--- a/openspec/specs/infrastructure/spec.md
+++ b/openspec/specs/infrastructure/spec.md
@ -15,7 +15,7 @@ All services SHALL be deployed via Docker Compose on the Hetzner server.
 - **THEN** the Journal, Planner, BRouter, PostgreSQL, and Garage containers start and are reachable

 ### Requirement: Service configuration
-Each service SHALL be configured via environment variables defined in Docker Compose.
+Each service SHALL be configured via environment variables defined in Docker Compose, with security best practices including non-root execution and security headers.

 #### Scenario: Journal configuration
 - **WHEN** the Journal container starts
@ -25,6 +25,14 @@ Each service SHALL be configured via environment variables defined in Docker Com
 - **WHEN** the Planner container starts
 - **THEN** it reads BROUTER_URL and DATABASE_URL from environment variables

+#### Scenario: Caddy security headers
+- **WHEN** Caddy proxies a request
+- **THEN** it adds HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy headers
+
+#### Scenario: Caddy scanner blocking
+- **WHEN** a request matches known scanner paths (.env, .git, wp-config, etc.)
+- **THEN** Caddy returns 403 without forwarding to the application
+
 ### Requirement: PostgreSQL with PostGIS
 The database SHALL be PostgreSQL with the PostGIS extension for spatial queries.

@ -44,12 +52,20 @@ The infrastructure SHALL support downloading and updating Germany RD5 segments f
 - **THEN** RD5 segments are updated from brouter.de and the BRouter container is restarted

 ### Requirement: CI/CD pipeline
-GitHub Actions SHALL build and deploy both apps on push to main.
+GitHub Actions SHALL build, deploy, and security-scan both apps on push to main.

 #### Scenario: Push triggers deployment
 - **WHEN** code is pushed to the main branch
 - **THEN** GitHub Actions builds Docker images, pushes to ghcr.io/trails-cool/, and deploys to the Hetzner server

+#### Scenario: Gitleaks scan
+- **WHEN** a PR is opened
+- **THEN** gitleaks scans for committed secrets
+
+#### Scenario: Dependency audit
+- **WHEN** CI runs
+- **THEN** pnpm audit checks for high/critical vulnerabilities
+
 ### Requirement: Backup strategy
 The infrastructure SHALL include daily backups of the PostgreSQL database.

--- a/openspec/specs/security-hardening/spec.md
+++ b/openspec/specs/security-hardening/spec.md
@ -0,0 +1,59 @@
+## Requirements
+
+### Requirement: Security response headers
+All HTTP responses SHALL include security headers to protect against common web attacks.
+
+#### Scenario: HSTS header
+- **WHEN** a browser receives a response from trails.cool
+- **THEN** the response includes `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`
+
+#### Scenario: Content sniffing prevention
+- **WHEN** a browser receives a response
+- **THEN** the response includes `X-Content-Type-Options: nosniff`
+
+#### Scenario: Clickjacking prevention
+- **WHEN** a browser receives a response
+- **THEN** the response includes `X-Frame-Options: DENY`
+
+### Requirement: Scanner path blocking
+Known vulnerability scanner paths SHALL be blocked at the reverse proxy level before reaching the application.
+
+#### Scenario: Env file scanner
+- **WHEN** a request is made to `/.env`, `/.env.local`, `/.env.prod`, or similar paths
+- **THEN** Caddy returns 403 without forwarding to the application
+
+#### Scenario: Git config scanner
+- **WHEN** a request is made to `/.git/config` or `/.git/HEAD`
+- **THEN** Caddy returns 403 without forwarding to the application
+
+### Requirement: Secret scanning in CI
+The CI pipeline SHALL scan commits for accidentally committed secrets.
+
+#### Scenario: Secret detected
+- **WHEN** a PR contains a committed API key, token, or password
+- **THEN** the CI pipeline fails with a clear message indicating the leaked secret
+
+#### Scenario: Known public values allowed
+- **WHEN** a known-public value (e.g., Sentry DSN) is committed
+- **THEN** gitleaks allows it via the `.gitleaks.toml` allowlist
+
+### Requirement: Dependency vulnerability scanning
+The CI pipeline SHALL check for known vulnerabilities in dependencies.
+
+#### Scenario: High severity vulnerability
+- **WHEN** a dependency has a high or critical vulnerability advisory
+- **THEN** the CI pipeline fails
+
+### Requirement: Non-root Docker containers
+Application containers SHALL run as a non-root user.
+
+#### Scenario: Container user
+- **WHEN** a container starts
+- **THEN** the process runs as a non-root user (not UID 0)
+
+### Requirement: Vulnerability disclosure policy
+The repository SHALL include a SECURITY.md with responsible disclosure instructions.
+
+#### Scenario: Security contact
+- **WHEN** a security researcher finds a vulnerability
+- **THEN** SECURITY.md provides clear instructions for reporting it
--- a/package.json
+++ b/package.json
@ -22,6 +22,11 @@
    "dev:services": "docker compose -f docker-compose.dev.yml up -d",
    "dev:full": "./scripts/dev.sh"
  },
+  "pnpm": {
+    "overrides": {
+      "picomatch@>=4.0.0 <4.0.4": "4.0.4"
+    }
+  },
  "devDependencies": {
    "@eslint/js": "^10.0.1",
    "@playwright/test": "^1.58.2",
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@ -50,7 +50,7 @@ catalogs:
      version: 6.4.1

 overrides:
-  esbuild: '>=0.25.0'
+  picomatch@>=4.0.0 <4.0.4: 4.0.4

 importers:

@ -581,156 +581,444 @@ packages:
    resolution: {integrity: sha512-FxEMIkJKnodyA1OaCUoEvbYRkoZlLZ4d/eXFu9Fh8CbBBgP5EmZxrfTRyN0qpXZ4vOvqnE5YdRdcrmUUXuU+dA==}
    deprecated: 'Merged into tsx: https://tsx.is'

+  '@esbuild/aix-ppc64@0.25.12':
+    resolution: {integrity: sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
  '@esbuild/aix-ppc64@0.27.4':
    resolution: {integrity: sha512-cQPwL2mp2nSmHHJlCyoXgHGhbEPMrEEU5xhkcy3Hs/O7nGZqEpZ2sUtLaL9MORLtDfRvVl2/3PAuEkYZH0Ty8Q==}
    engines: {node: '>=18'}
    cpu: [ppc64]
    os: [aix]

+  '@esbuild/android-arm64@0.18.20':
+    resolution: {integrity: sha512-Nz4rJcchGDtENV0eMKUNa6L12zz2zBDXuhj/Vjh18zGqB44Bi7MBMSXjgunJgjRhCmKOjnPuZp4Mb6OKqtMHLQ==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm64@0.25.12':
+    resolution: {integrity: sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
  '@esbuild/android-arm64@0.27.4':
    resolution: {integrity: sha512-gdLscB7v75wRfu7QSm/zg6Rx29VLdy9eTr2t44sfTW7CxwAtQghZ4ZnqHk3/ogz7xao0QAgrkradbBzcqFPasw==}
    engines: {node: '>=18'}
    cpu: [arm64]
    os: [android]

+  '@esbuild/android-arm@0.18.20':
+    resolution: {integrity: sha512-fyi7TDI/ijKKNZTUJAQqiG5T7YjJXgnzkURqmGj13C6dCqckZBLdl4h7bkhHt/t0WP+zO9/zwroDvANaOqO5Sw==}
+    engines: {node: '>=12'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-arm@0.25.12':
+    resolution: {integrity: sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
  '@esbuild/android-arm@0.27.4':
    resolution: {integrity: sha512-X9bUgvxiC8CHAGKYufLIHGXPJWnr0OCdR0anD2e21vdvgCI8lIfqFbnoeOz7lBjdrAGUhqLZLcQo6MLhTO2DKQ==}
    engines: {node: '>=18'}
    cpu: [arm]
    os: [android]

+  '@esbuild/android-x64@0.18.20':
+    resolution: {integrity: sha512-8GDdlePJA8D6zlZYJV/jnrRAi6rOiNaCC/JclcXpB+KIuvfBN4owLtgzY2bsxnx666XjJx2kDPUmnTtR8qKQUg==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/android-x64@0.25.12':
+    resolution: {integrity: sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
  '@esbuild/android-x64@0.27.4':
    resolution: {integrity: sha512-PzPFnBNVF292sfpfhiyiXCGSn9HZg5BcAz+ivBuSsl6Rk4ga1oEXAamhOXRFyMcjwr2DVtm40G65N3GLeH1Lvw==}
    engines: {node: '>=18'}
    cpu: [x64]
    os: [android]

+  '@esbuild/darwin-arm64@0.18.20':
+    resolution: {integrity: sha512-bxRHW5kHU38zS2lPTPOyuyTm+S+eobPUnTNkdJEfAddYgEcll4xkT8DB9d2008DtTbl7uJag2HuE5NZAZgnNEA==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-arm64@0.25.12':
+    resolution: {integrity: sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
  '@esbuild/darwin-arm64@0.27.4':
    resolution: {integrity: sha512-b7xaGIwdJlht8ZFCvMkpDN6uiSmnxxK56N2GDTMYPr2/gzvfdQN8rTfBsvVKmIVY/X7EM+/hJKEIbbHs9oA4tQ==}
    engines: {node: '>=18'}
    cpu: [arm64]
    os: [darwin]

+  '@esbuild/darwin-x64@0.18.20':
+    resolution: {integrity: sha512-pc5gxlMDxzm513qPGbCbDukOdsGtKhfxD1zJKXjCCcU7ju50O7MeAZ8c4krSJcOIJGFR+qx21yMMVYwiQvyTyQ==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.25.12':
+    resolution: {integrity: sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
  '@esbuild/darwin-x64@0.27.4':
    resolution: {integrity: sha512-sR+OiKLwd15nmCdqpXMnuJ9W2kpy0KigzqScqHI3Hqwr7IXxBp3Yva+yJwoqh7rE8V77tdoheRYataNKL4QrPw==}
    engines: {node: '>=18'}
    cpu: [x64]
    os: [darwin]

+  '@esbuild/freebsd-arm64@0.18.20':
+    resolution: {integrity: sha512-yqDQHy4QHevpMAaxhhIwYPMv1NECwOvIpGCZkECn8w2WFHXjEwrBn3CeNIYsibZ/iZEUemj++M26W3cNR5h+Tw==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    resolution: {integrity: sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
  '@esbuild/freebsd-arm64@0.27.4':
    resolution: {integrity: sha512-jnfpKe+p79tCnm4GVav68A7tUFeKQwQyLgESwEAUzyxk/TJr4QdGog9sqWNcUbr/bZt/O/HXouspuQDd9JxFSw==}
    engines: {node: '>=18'}
    cpu: [arm64]
    os: [freebsd]

+  '@esbuild/freebsd-x64@0.18.20':
+    resolution: {integrity: sha512-tgWRPPuQsd3RmBZwarGVHZQvtzfEBOreNuxEMKFcd5DaDn2PbBxfwLcj4+aenoh7ctXcbXmOQIn8HI6mCSw5MQ==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.25.12':
+    resolution: {integrity: sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
  '@esbuild/freebsd-x64@0.27.4':
    resolution: {integrity: sha512-2kb4ceA/CpfUrIcTUl1wrP/9ad9Atrp5J94Lq69w7UwOMolPIGrfLSvAKJp0RTvkPPyn6CIWrNy13kyLikZRZQ==}
    engines: {node: '>=18'}
    cpu: [x64]
    os: [freebsd]

+  '@esbuild/linux-arm64@0.18.20':
+    resolution: {integrity: sha512-2YbscF+UL7SQAVIpnWvYwM+3LskyDmPhe31pE7/aoTMFKKzIc9lLbyGUpmmb8a8AixOL61sQ/mFh3jEjHYFvdA==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm64@0.25.12':
+    resolution: {integrity: sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
  '@esbuild/linux-arm64@0.27.4':
    resolution: {integrity: sha512-7nQOttdzVGth1iz57kxg9uCz57dxQLHWxopL6mYuYthohPKEK0vU0C3O21CcBK6KDlkYVcnDXY099HcCDXd9dA==}
    engines: {node: '>=18'}
    cpu: [arm64]
    os: [linux]

+  '@esbuild/linux-arm@0.18.20':
+    resolution: {integrity: sha512-/5bHkMWnq1EgKr1V+Ybz3s1hWXok7mDFUMQ4cG10AfW3wL02PSZi5kFpYKrptDsgb2WAJIvRcDm+qIvXf/apvg==}
+    engines: {node: '>=12'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.25.12':
+    resolution: {integrity: sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
  '@esbuild/linux-arm@0.27.4':
    resolution: {integrity: sha512-aBYgcIxX/wd5n2ys0yESGeYMGF+pv6g0DhZr3G1ZG4jMfruU9Tl1i2Z+Wnj9/KjGz1lTLCcorqE2viePZqj4Eg==}
    engines: {node: '>=18'}
    cpu: [arm]
    os: [linux]

+  '@esbuild/linux-ia32@0.18.20':
+    resolution: {integrity: sha512-P4etWwq6IsReT0E1KHU40bOnzMHoH73aXp96Fs8TIT6z9Hu8G6+0SHSw9i2isWrD2nbx2qo5yUqACgdfVGx7TA==}
+    engines: {node: '>=12'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.25.12':
+    resolution: {integrity: sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
  '@esbuild/linux-ia32@0.27.4':
    resolution: {integrity: sha512-oPtixtAIzgvzYcKBQM/qZ3R+9TEUd1aNJQu0HhGyqtx6oS7qTpvjheIWBbes4+qu1bNlo2V4cbkISr8q6gRBFA==}
    engines: {node: '>=18'}
    cpu: [ia32]
    os: [linux]

+  '@esbuild/linux-loong64@0.18.20':
+    resolution: {integrity: sha512-nXW8nqBTrOpDLPgPY9uV+/1DjxoQ7DoB2N8eocyq8I9XuqJ7BiAMDMf9n1xZM9TgW0J8zrquIb/A7s3BJv7rjg==}
+    engines: {node: '>=12'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.25.12':
+    resolution: {integrity: sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
  '@esbuild/linux-loong64@0.27.4':
    resolution: {integrity: sha512-8mL/vh8qeCoRcFH2nM8wm5uJP+ZcVYGGayMavi8GmRJjuI3g1v6Z7Ni0JJKAJW+m0EtUuARb6Lmp4hMjzCBWzA==}
    engines: {node: '>=18'}
    cpu: [loong64]
    os: [linux]

+  '@esbuild/linux-mips64el@0.18.20':
+    resolution: {integrity: sha512-d5NeaXZcHp8PzYy5VnXV3VSd2D328Zb+9dEq5HE6bw6+N86JVPExrA6O68OPwobntbNJ0pzCpUFZTo3w0GyetQ==}
+    engines: {node: '>=12'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.25.12':
+    resolution: {integrity: sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
  '@esbuild/linux-mips64el@0.27.4':
    resolution: {integrity: sha512-1RdrWFFiiLIW7LQq9Q2NES+HiD4NyT8Itj9AUeCl0IVCA459WnPhREKgwrpaIfTOe+/2rdntisegiPWn/r/aAw==}
    engines: {node: '>=18'}
    cpu: [mips64el]
    os: [linux]

+  '@esbuild/linux-ppc64@0.18.20':
+    resolution: {integrity: sha512-WHPyeScRNcmANnLQkq6AfyXRFr5D6N2sKgkFo2FqguP44Nw2eyDlbTdZwd9GYk98DZG9QItIiTlFLHJHjxP3FA==}
+    engines: {node: '>=12'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.25.12':
+    resolution: {integrity: sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
  '@esbuild/linux-ppc64@0.27.4':
    resolution: {integrity: sha512-tLCwNG47l3sd9lpfyx9LAGEGItCUeRCWeAx6x2Jmbav65nAwoPXfewtAdtbtit/pJFLUWOhpv0FpS6GQAmPrHA==}
    engines: {node: '>=18'}
    cpu: [ppc64]
    os: [linux]

+  '@esbuild/linux-riscv64@0.18.20':
+    resolution: {integrity: sha512-WSxo6h5ecI5XH34KC7w5veNnKkju3zBRLEQNY7mv5mtBmrP/MjNBCAlsM2u5hDBlS3NGcTQpoBvRzqBcRtpq1A==}
+    engines: {node: '>=12'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.25.12':
+    resolution: {integrity: sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
  '@esbuild/linux-riscv64@0.27.4':
    resolution: {integrity: sha512-BnASypppbUWyqjd1KIpU4AUBiIhVr6YlHx/cnPgqEkNoVOhHg+YiSVxM1RLfiy4t9cAulbRGTNCKOcqHrEQLIw==}
    engines: {node: '>=18'}
    cpu: [riscv64]
    os: [linux]

+  '@esbuild/linux-s390x@0.18.20':
+    resolution: {integrity: sha512-+8231GMs3mAEth6Ja1iK0a1sQ3ohfcpzpRLH8uuc5/KVDFneH6jtAJLFGafpzpMRO6DzJ6AvXKze9LfFMrIHVQ==}
+    engines: {node: '>=12'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.25.12':
+    resolution: {integrity: sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
  '@esbuild/linux-s390x@0.27.4':
    resolution: {integrity: sha512-+eUqgb/Z7vxVLezG8bVB9SfBie89gMueS+I0xYh2tJdw3vqA/0ImZJ2ROeWwVJN59ihBeZ7Tu92dF/5dy5FttA==}
    engines: {node: '>=18'}
    cpu: [s390x]
    os: [linux]

+  '@esbuild/linux-x64@0.18.20':
+    resolution: {integrity: sha512-UYqiqemphJcNsFEskc73jQ7B9jgwjWrSayxawS6UVFZGWrAAtkzjxSqnoclCXxWtfwLdzU+vTpcNYhpn43uP1w==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.25.12':
+    resolution: {integrity: sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
  '@esbuild/linux-x64@0.27.4':
    resolution: {integrity: sha512-S5qOXrKV8BQEzJPVxAwnryi2+Iq5pB40gTEIT69BQONqR7JH1EPIcQ/Uiv9mCnn05jff9umq/5nqzxlqTOg9NA==}
    engines: {node: '>=18'}
    cpu: [x64]
    os: [linux]

+  '@esbuild/netbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
  '@esbuild/netbsd-arm64@0.27.4':
    resolution: {integrity: sha512-xHT8X4sb0GS8qTqiwzHqpY00C95DPAq7nAwX35Ie/s+LO9830hrMd3oX0ZMKLvy7vsonee73x0lmcdOVXFzd6Q==}
    engines: {node: '>=18'}
    cpu: [arm64]
    os: [netbsd]

+  '@esbuild/netbsd-x64@0.18.20':
+    resolution: {integrity: sha512-iO1c++VP6xUBUmltHZoMtCUdPlnPGdBom6IrO4gyKPFFVBKioIImVooR5I83nTew5UOYrk3gIJhbZh8X44y06A==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.25.12':
+    resolution: {integrity: sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
  '@esbuild/netbsd-x64@0.27.4':
    resolution: {integrity: sha512-RugOvOdXfdyi5Tyv40kgQnI0byv66BFgAqjdgtAKqHoZTbTF2QqfQrFwa7cHEORJf6X2ht+l9ABLMP0dnKYsgg==}
    engines: {node: '>=18'}
    cpu: [x64]
    os: [netbsd]

+  '@esbuild/openbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
  '@esbuild/openbsd-arm64@0.27.4':
    resolution: {integrity: sha512-2MyL3IAaTX+1/qP0O1SwskwcwCoOI4kV2IBX1xYnDDqthmq5ArrW94qSIKCAuRraMgPOmG0RDTA74mzYNQA9ow==}
    engines: {node: '>=18'}
    cpu: [arm64]
    os: [openbsd]

+  '@esbuild/openbsd-x64@0.18.20':
+    resolution: {integrity: sha512-e5e4YSsuQfX4cxcygw/UCPIEP6wbIL+se3sxPdCiMbFLBWu0eiZOJ7WoD+ptCLrmjZBK1Wk7I6D/I3NglUGOxg==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.25.12':
+    resolution: {integrity: sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
  '@esbuild/openbsd-x64@0.27.4':
    resolution: {integrity: sha512-u8fg/jQ5aQDfsnIV6+KwLOf1CmJnfu1ShpwqdwC0uA7ZPwFws55Ngc12vBdeUdnuWoQYx/SOQLGDcdlfXhYmXQ==}
    engines: {node: '>=18'}
    cpu: [x64]
    os: [openbsd]

+  '@esbuild/openharmony-arm64@0.25.12':
+    resolution: {integrity: sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
  '@esbuild/openharmony-arm64@0.27.4':
    resolution: {integrity: sha512-JkTZrl6VbyO8lDQO3yv26nNr2RM2yZzNrNHEsj9bm6dOwwu9OYN28CjzZkH57bh4w0I2F7IodpQvUAEd1mbWXg==}
    engines: {node: '>=18'}
    cpu: [arm64]
    os: [openharmony]

+  '@esbuild/sunos-x64@0.18.20':
+    resolution: {integrity: sha512-kDbFRFp0YpTQVVrqUd5FTYmWo45zGaXe0X8E1G/LKFC0v8x0vWrhOWSLITcCn63lmZIxfOMXtCfti/RxN/0wnQ==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/sunos-x64@0.25.12':
+    resolution: {integrity: sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
  '@esbuild/sunos-x64@0.27.4':
    resolution: {integrity: sha512-/gOzgaewZJfeJTlsWhvUEmUG4tWEY2Spp5M20INYRg2ZKl9QPO3QEEgPeRtLjEWSW8FilRNacPOg8R1uaYkA6g==}
    engines: {node: '>=18'}
    cpu: [x64]
    os: [sunos]

+  '@esbuild/win32-arm64@0.18.20':
+    resolution: {integrity: sha512-ddYFR6ItYgoaq4v4JmQQaAI5s7npztfV4Ag6NrhiaW0RrnOXqBkgwZLofVTlq1daVTQNhtI5oieTvkRPfZrePg==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-arm64@0.25.12':
+    resolution: {integrity: sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
  '@esbuild/win32-arm64@0.27.4':
    resolution: {integrity: sha512-Z9SExBg2y32smoDQdf1HRwHRt6vAHLXcxD2uGgO/v2jK7Y718Ix4ndsbNMU/+1Qiem9OiOdaqitioZwxivhXYg==}
    engines: {node: '>=18'}
    cpu: [arm64]
    os: [win32]

+  '@esbuild/win32-ia32@0.18.20':
+    resolution: {integrity: sha512-Wv7QBi3ID/rROT08SABTS7eV4hX26sVduqDOTe1MvGMjNd3EjOz4b7zeexIR62GTIEKrfJXKL9LFxTYgkyeu7g==}
+    engines: {node: '>=12'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.25.12':
+    resolution: {integrity: sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
  '@esbuild/win32-ia32@0.27.4':
    resolution: {integrity: sha512-DAyGLS0Jz5G5iixEbMHi5KdiApqHBWMGzTtMiJ72ZOLhbu/bzxgAe8Ue8CTS3n3HbIUHQz/L51yMdGMeoxXNJw==}
    engines: {node: '>=18'}
    cpu: [ia32]
    os: [win32]

+  '@esbuild/win32-x64@0.18.20':
+    resolution: {integrity: sha512-kTdfRcSiDfQca/y9QIkng02avJ+NCaQvrMejlsB3RRv5sE9rRoeBPISaZpKxHELzRxZyLvNts1P27W3wV+8geQ==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.25.12':
+    resolution: {integrity: sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
  '@esbuild/win32-x64@0.27.4':
    resolution: {integrity: sha512-+knoa0BDoeXgkNvvV1vvbZX4+hizelrkwmGJBdT17t8FNPwG2lKemmuMZlmaNQ3ws3DKKCxpb4zRZEIp3UxFCg==}
    engines: {node: '>=18'}
@ -2201,6 +2489,16 @@ packages:
    resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
    engines: {node: '>= 0.4'}

+  esbuild@0.18.20:
+    resolution: {integrity: sha512-ceqxoedUrcayh7Y7ZX6NdbbDzGROiyVBgC4PriJThBKSVPWnnFHZAkfI1lJT8QFkOwH4qOS2SJkS4wvpGl8BpA==}
+    engines: {node: '>=12'}
+    hasBin: true
+
+  esbuild@0.25.12:
+    resolution: {integrity: sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==}
+    engines: {node: '>=18'}
+    hasBin: true
+
  esbuild@0.27.4:
    resolution: {integrity: sha512-Rq4vbHnYkK5fws5NF7MYTU68FPRE1ajX7heQ/8QXXWqNgqqJ/GkmmyxIzUnf2Sr/bakf8l54716CcMGHYhMrrQ==}
    engines: {node: '>=18'}
@ -2300,7 +2598,7 @@ packages:
    resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
    engines: {node: '>=12.0.0'}
    peerDependencies:
-      picomatch: ^3 || ^4
+      picomatch: 4.0.4
    peerDependenciesMeta:
      picomatch:
        optional: true
@ -2798,8 +3096,8 @@ packages:
  picocolors@1.1.1:
    resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}

-  picomatch@4.0.3:
-    resolution: {integrity: sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==}
+  picomatch@4.0.4:
+    resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
    engines: {node: '>=12'}

  pkg-types@2.3.0:
@ -3640,7 +3938,7 @@ snapshots:

  '@esbuild-kit/core-utils@3.3.2':
    dependencies:
-      esbuild: 0.27.4
+      esbuild: 0.18.20
      source-map-support: 0.5.21

  '@esbuild-kit/esm-loader@2.6.5':
@ -3648,81 +3946,225 @@ snapshots:
      '@esbuild-kit/core-utils': 3.3.2
      get-tsconfig: 4.13.7

+  '@esbuild/aix-ppc64@0.25.12':
+    optional: true
+
  '@esbuild/aix-ppc64@0.27.4':
    optional: true

+  '@esbuild/android-arm64@0.18.20':
+    optional: true
+
+  '@esbuild/android-arm64@0.25.12':
+    optional: true
+
  '@esbuild/android-arm64@0.27.4':
    optional: true

+  '@esbuild/android-arm@0.18.20':
+    optional: true
+
+  '@esbuild/android-arm@0.25.12':
+    optional: true
+
  '@esbuild/android-arm@0.27.4':
    optional: true

+  '@esbuild/android-x64@0.18.20':
+    optional: true
+
+  '@esbuild/android-x64@0.25.12':
+    optional: true
+
  '@esbuild/android-x64@0.27.4':
    optional: true

+  '@esbuild/darwin-arm64@0.18.20':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.25.12':
+    optional: true
+
  '@esbuild/darwin-arm64@0.27.4':
    optional: true

+  '@esbuild/darwin-x64@0.18.20':
+    optional: true
+
+  '@esbuild/darwin-x64@0.25.12':
+    optional: true
+
  '@esbuild/darwin-x64@0.27.4':
    optional: true

+  '@esbuild/freebsd-arm64@0.18.20':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    optional: true
+
  '@esbuild/freebsd-arm64@0.27.4':
    optional: true

+  '@esbuild/freebsd-x64@0.18.20':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.25.12':
+    optional: true
+
  '@esbuild/freebsd-x64@0.27.4':
    optional: true

+  '@esbuild/linux-arm64@0.18.20':
+    optional: true
+
+  '@esbuild/linux-arm64@0.25.12':
+    optional: true
+
  '@esbuild/linux-arm64@0.27.4':
    optional: true

+  '@esbuild/linux-arm@0.18.20':
+    optional: true
+
+  '@esbuild/linux-arm@0.25.12':
+    optional: true
+
  '@esbuild/linux-arm@0.27.4':
    optional: true

+  '@esbuild/linux-ia32@0.18.20':
+    optional: true
+
+  '@esbuild/linux-ia32@0.25.12':
+    optional: true
+
  '@esbuild/linux-ia32@0.27.4':
    optional: true

+  '@esbuild/linux-loong64@0.18.20':
+    optional: true
+
+  '@esbuild/linux-loong64@0.25.12':
+    optional: true
+
  '@esbuild/linux-loong64@0.27.4':
    optional: true

+  '@esbuild/linux-mips64el@0.18.20':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.25.12':
+    optional: true
+
  '@esbuild/linux-mips64el@0.27.4':
    optional: true

+  '@esbuild/linux-ppc64@0.18.20':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.25.12':
+    optional: true
+
  '@esbuild/linux-ppc64@0.27.4':
    optional: true

+  '@esbuild/linux-riscv64@0.18.20':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.25.12':
+    optional: true
+
  '@esbuild/linux-riscv64@0.27.4':
    optional: true

+  '@esbuild/linux-s390x@0.18.20':
+    optional: true
+
+  '@esbuild/linux-s390x@0.25.12':
+    optional: true
+
  '@esbuild/linux-s390x@0.27.4':
    optional: true

+  '@esbuild/linux-x64@0.18.20':
+    optional: true
+
+  '@esbuild/linux-x64@0.25.12':
+    optional: true
+
  '@esbuild/linux-x64@0.27.4':
    optional: true

+  '@esbuild/netbsd-arm64@0.25.12':
+    optional: true
+
  '@esbuild/netbsd-arm64@0.27.4':
    optional: true

+  '@esbuild/netbsd-x64@0.18.20':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.25.12':
+    optional: true
+
  '@esbuild/netbsd-x64@0.27.4':
    optional: true

+  '@esbuild/openbsd-arm64@0.25.12':
+    optional: true
+
  '@esbuild/openbsd-arm64@0.27.4':
    optional: true

+  '@esbuild/openbsd-x64@0.18.20':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.25.12':
+    optional: true
+
  '@esbuild/openbsd-x64@0.27.4':
    optional: true

+  '@esbuild/openharmony-arm64@0.25.12':
+    optional: true
+
  '@esbuild/openharmony-arm64@0.27.4':
    optional: true

+  '@esbuild/sunos-x64@0.18.20':
+    optional: true
+
+  '@esbuild/sunos-x64@0.25.12':
+    optional: true
+
  '@esbuild/sunos-x64@0.27.4':
    optional: true

+  '@esbuild/win32-arm64@0.18.20':
+    optional: true
+
+  '@esbuild/win32-arm64@0.25.12':
+    optional: true
+
  '@esbuild/win32-arm64@0.27.4':
    optional: true

+  '@esbuild/win32-ia32@0.18.20':
+    optional: true
+
+  '@esbuild/win32-ia32@0.25.12':
+    optional: true
+
  '@esbuild/win32-ia32@0.27.4':
    optional: true

+  '@esbuild/win32-x64@0.18.20':
+    optional: true
+
+  '@esbuild/win32-x64@0.25.12':
+    optional: true
+
  '@esbuild/win32-x64@0.27.4':
    optional: true

@ -5083,7 +5525,7 @@ snapshots:
    dependencies:
      '@drizzle-team/brocli': 0.10.2
      '@esbuild-kit/esm-loader': 2.6.5
-      esbuild: 0.27.4
+      esbuild: 0.25.12
      tsx: 4.21.0

  drizzle-orm@0.44.7(@opentelemetry/api@1.9.0)(@types/pg@8.15.6)(postgres@3.4.8):
@ -5137,6 +5579,60 @@ snapshots:
    dependencies:
      es-errors: 1.3.0

+  esbuild@0.18.20:
+    optionalDependencies:
+      '@esbuild/android-arm': 0.18.20
+      '@esbuild/android-arm64': 0.18.20
+      '@esbuild/android-x64': 0.18.20
+      '@esbuild/darwin-arm64': 0.18.20
+      '@esbuild/darwin-x64': 0.18.20
+      '@esbuild/freebsd-arm64': 0.18.20
+      '@esbuild/freebsd-x64': 0.18.20
+      '@esbuild/linux-arm': 0.18.20
+      '@esbuild/linux-arm64': 0.18.20
+      '@esbuild/linux-ia32': 0.18.20
+      '@esbuild/linux-loong64': 0.18.20
+      '@esbuild/linux-mips64el': 0.18.20
+      '@esbuild/linux-ppc64': 0.18.20
+      '@esbuild/linux-riscv64': 0.18.20
+      '@esbuild/linux-s390x': 0.18.20
+      '@esbuild/linux-x64': 0.18.20
+      '@esbuild/netbsd-x64': 0.18.20
+      '@esbuild/openbsd-x64': 0.18.20
+      '@esbuild/sunos-x64': 0.18.20
+      '@esbuild/win32-arm64': 0.18.20
+      '@esbuild/win32-ia32': 0.18.20
+      '@esbuild/win32-x64': 0.18.20
+
+  esbuild@0.25.12:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.25.12
+      '@esbuild/android-arm': 0.25.12
+      '@esbuild/android-arm64': 0.25.12
+      '@esbuild/android-x64': 0.25.12
+      '@esbuild/darwin-arm64': 0.25.12
+      '@esbuild/darwin-x64': 0.25.12
+      '@esbuild/freebsd-arm64': 0.25.12
+      '@esbuild/freebsd-x64': 0.25.12
+      '@esbuild/linux-arm': 0.25.12
+      '@esbuild/linux-arm64': 0.25.12
+      '@esbuild/linux-ia32': 0.25.12
+      '@esbuild/linux-loong64': 0.25.12
+      '@esbuild/linux-mips64el': 0.25.12
+      '@esbuild/linux-ppc64': 0.25.12
+      '@esbuild/linux-riscv64': 0.25.12
+      '@esbuild/linux-s390x': 0.25.12
+      '@esbuild/linux-x64': 0.25.12
+      '@esbuild/netbsd-arm64': 0.25.12
+      '@esbuild/netbsd-x64': 0.25.12
+      '@esbuild/openbsd-arm64': 0.25.12
+      '@esbuild/openbsd-x64': 0.25.12
+      '@esbuild/openharmony-arm64': 0.25.12
+      '@esbuild/sunos-x64': 0.25.12
+      '@esbuild/win32-arm64': 0.25.12
+      '@esbuild/win32-ia32': 0.25.12
+      '@esbuild/win32-x64': 0.25.12
+
  esbuild@0.27.4:
    optionalDependencies:
      '@esbuild/aix-ppc64': 0.27.4
@ -5296,9 +5792,9 @@ snapshots:

  fast-levenshtein@2.0.6: {}

-  fdir@6.5.0(picomatch@4.0.3):
+  fdir@6.5.0(picomatch@4.0.4):
    optionalDependencies:
-      picomatch: 4.0.3
+      picomatch: 4.0.4

  file-entry-cache@8.0.0:
    dependencies:
@ -5738,7 +6234,7 @@ snapshots:

  picocolors@1.1.1: {}

-  picomatch@4.0.3: {}
+  picomatch@4.0.4: {}

  pkg-types@2.3.0:
    dependencies:
@ -6014,8 +6510,8 @@ snapshots:

  tinyglobby@0.2.15:
    dependencies:
-      fdir: 6.5.0(picomatch@4.0.3)
-      picomatch: 4.0.3
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4

  tinyrainbow@3.1.0: {}

@ -6140,9 +6636,9 @@ snapshots:

  vite@6.4.1(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0):
    dependencies:
-      esbuild: 0.27.4
-      fdir: 6.5.0(picomatch@4.0.3)
-      picomatch: 4.0.3
+      esbuild: 0.25.12
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
      postcss: 8.5.8
      rollup: 4.60.0
      tinyglobby: 0.2.15
@ -6156,8 +6652,8 @@ snapshots:
  vite@7.3.1(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.21.0):
    dependencies:
      esbuild: 0.27.4
-      fdir: 6.5.0(picomatch@4.0.3)
-      picomatch: 4.0.3
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
      postcss: 8.5.8
      rollup: 4.60.0
      tinyglobby: 0.2.15
@ -6182,7 +6678,7 @@ snapshots:
      magic-string: 0.30.21
      obug: 2.1.1
      pathe: 2.0.3
-      picomatch: 4.0.3
+      picomatch: 4.0.4
      std-env: 4.0.0
      tinybench: 2.9.0
      tinyexec: 1.0.4