* fix: upgrade node-forge to 1.4.2 for CVE-2026-85393 (INS-3936)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* fix: upgrade node-forge to 1.4.2 in component-docs lockfile (INS-3936)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
* fix: bump @xmldom/xmldom to ^0.9.12 (CVE-2026-41675)
0.9.10 has a known parser vulnerability; 0.9.12 is the latest patched release.
* fix: bump dompurify to ^3.4.14
3.4.13 has a known sanitizer bypass; 3.4.14 is the patched release.
* fix: bump ajv to ^8.20.0
8.18.0 has a known prototype-pollution issue in schema compilation; 8.20.0 is the patched release.
* fix: bump es-toolkit to ^1.51.0
1.45.1 has a known ReDoS in one of its string utilities; 1.51.0 is the patched release.
* fix: bump @apidevtools/swagger-parser to 12.1.0
Pulls in json-schema-ref-parser 14.0.1, resolving a known vulnerability in the
$ref-resolution path used when validating imported OpenAPI/Swagger documents.
Only SwaggerParser.validate() is used at the two call sites and its signature
is unchanged across this range.
* fix: bump @sentry/electron to ^7.17.0
Pulls in @sentry/node 10.70.0, resolving vulnerabilities in its bundled
@opentelemetry/core and cjs-module-lexer instrumentation dependencies.
Sentry.init options, captureException, browserTracingIntegration, and
getCurrentScope().setUser() are all used unchanged across this range.
* fix: bump zod to ^4.4.0
3.25.76 has a known validation-bypass fixed only in the v4 line. The app's
own schema code already imports from the zod/v4 subpath, so no source
changes are needed for the bump itself.
* fix: bump @rjsf/core, @rjsf/utils, @rjsf/validator-ajv8 to 6.8.0
Moves off the 6.0.0 beta onto the stable release line, which pulls in
markdown-to-jsx 9.x and resolves a known vulnerability in the pinned 7.x
line. The withTheme/FormProps/RJSFSchema/UiSchema/validateForm API surface
used by this app's JSON-schema forms is unchanged across this range.
* fix: refresh jose lockfile entry to 6.2.10
6.2.2 has a known vulnerability; 6.2.10 is already within the existing
allowed range (^6.1.3) declared by @modelcontextprotocol/sdk, so no
manifest change is needed, just an up-to-date resolution.
* fix: adapt rjsf theme templates to @rjsf/utils 6.8.0 prop changes
WrapIfAdditionalTemplate's onKeyChange/onDropPropertyClick became
onKeyRenameBlur/onRemoveProperty, ObjectFieldTemplate's idSchema/onAddClick
became fieldPathId/onAddProperty, and ArrayFieldTemplate no longer receives
raw item pieces - items are now pre-rendered elements, so the per-item
border/delete-button layout moved into a new ArrayFieldItemTemplate.
* Revert "fix: bump zod to ^4.4.0"
This reverts commit 54f1d5aa4c81ff64bf4cb9f9d478440b7311e2cd.
The v3 to v4 bump breaks real-world collection validation: import-v5-parser's
discriminated/recursive union schemas reject valid v5 collection files under
the released zod@4.4.0 (unlike the bundled zod/v4 preview subpath used
during development), failing import, export, and CLI collection-run
end-to-end tests. Deferring this upgrade separately rather than shipping a
functional regression.
* chore: regenerate lockfile after rebase onto develop
* fix: bump undici to ^7.29.1
* fix: bump @xmldom/xmldom 0.8.x to 0.8.15
* fix: bump proxy-addr to 2.0.8
* fix: bump compression to 1.8.2
* fix: bump source-map-js to 1.2.2
* fix: bump http-cache-semantics to 4.3.0
* fix: bump fast-uri to 3.1.8
* fix: bump proxy-addr, compression, source-map-js, http-cache-semantics, fast-uri in component-docs lockfile
* feat: form component
* feat: use twMerge to support class overide
* Spike: Add markdown format doc support for base-components (#9368)
* initial check-in
* add things
* update select.mdx
* use react live things
* add package-json
* Revert "add package-json"
This reverts commit c57abf6178f39e631ec7fe6634cb4e6afd950fdb.
* update comment
* update docs
* type fix
* tailwind v4 upgrade
* upgrade tailwind v4 in docusaurus
* feat: add more components (#9426)
* update
* update
---------
Co-authored-by: Kent Wang <kent.wang@konghq.com>
