fix(deps): batch security and dependency upgrades

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
       # actions/checkout v7.0.1
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       # pnpm/action-setup v6.0.9 -- 不传 version,由 package.json 的 packageManager 单一真相源决定
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86
       # actions/setup-node v7.0.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
@@ -44,7 +44,7 @@ jobs:
       # actions/checkout v7.0.1
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       # pnpm/action-setup v6.0.9 -- 不传 version,由 package.json 的 packageManager 单一真相源决定
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86
       # actions/setup-node v7.0.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
@@ -61,7 +61,7 @@ jobs:
       # actions/checkout v7.0.1
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       # pnpm/action-setup v6.0.9 -- 不传 version,由 package.json 的 packageManager 单一真相源决定
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86
       # actions/setup-node v7.0.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
@@ -86,7 +86,7 @@ jobs:
       # actions/checkout v7.0.1
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       # pnpm/action-setup v6.0.9 -- 不传 version,由 package.json 的 packageManager 单一真相源决定
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86
       # actions/setup-node v7.0.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
@@ -107,7 +107,7 @@ jobs:
       # actions/checkout v7.0.1
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       # pnpm/action-setup v6.0.9 -- 不传 version,由 package.json 的 packageManager 单一真相源决定
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86
       # actions/setup-node v7.0.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
@@ -130,7 +130,7 @@ jobs:
       # actions/checkout v7.0.1
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       # pnpm/action-setup v6.0.9 -- 不传 version,由 package.json 的 packageManager 单一真相源决定
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86
       # actions/setup-node v7.0.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:

.github/workflows/codeql.yml

@@ -57,7 +57,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -69,6 +69,6 @@ jobs:
           swift build --package-path sdk/macos
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3
         with:
           category: /language:${{ matrix.language }}

.github/workflows/dependency-review.yml

@@ -30,5 +30,7 @@ jobs:
       - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294
         with:
           fail-on-severity: high
-          deny-licenses: AGPL-1.0-or-later, AGPL-3.0-or-later, GPL-2.0-or-later, GPL-3.0-or-later, LGPL-2.0-or-later, LGPL-3.0-or-later, SSPL-1.0
+          # LGPL is intentionally allowed: `next>sharp` ships @img/sharp-libvips-*
+          # platform binaries under LGPL-3.0. Stronger copyleft (GPL/AGPL/SSPL) stays denied.
+          deny-licenses: AGPL-1.0-or-later, AGPL-3.0-or-later, GPL-2.0-or-later, GPL-3.0-or-later, SSPL-1.0
           comment-summary-in-pr: never

.github/workflows/scorecard.yml

@@ -51,6 +51,6 @@ jobs:
           retention-days: 5
 
       # github/codeql-action v4.37.3
-      - uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81
+      - uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3
         with:
           sarif_file: results.sarif

apps/console/package.json

@@ -38,7 +38,7 @@
     "@stylexjs/unplugin": "catalog:",
     "@types/react": "catalog:",
     "@types/react-dom": "catalog:",
-    "@vitejs/plugin-react": "^6.0.4",
+    "@vitejs/plugin-react": "^6.0.5",
     "jsdom": "catalog:",
     "typescript": "^6.0.3",
     "vite": "catalog:",

apps/console/src/routes/console/ManagedProjects.tsx

@@ -7,7 +7,7 @@ import { Trans, useLingui } from '@lingui/react/macro'
 import { useState } from 'react'
 import type { FormEvent, ReactNode } from 'react'
 import * as stylex from '@stylexjs/stylex'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { Alert, Badge, Button, Field, Input, Select } from '@xid-kit/web-ui/ui'
 import {
   ConsolePage,

apps/console/src/routes/org/OrgApiKeys.tsx

@@ -7,7 +7,7 @@ import { Trans, useLingui } from '@lingui/react/macro'
 import { useState } from 'react'
 import type { FormEvent, ReactNode } from 'react'
 import * as stylex from '@stylexjs/stylex'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { Alert, Badge, Button, Field, Input, Select } from '@xid-kit/web-ui/ui'
 import type { BadgeTone } from '@xid-kit/web-ui/ui'
 import {

apps/console/src/routes/org/OrgApplications.tsx

@@ -7,7 +7,7 @@ import { Trans, useLingui } from '@lingui/react/macro'
 import { useState } from 'react'
 import type { FormEvent, ReactNode } from 'react'
 import * as stylex from '@stylexjs/stylex'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { Alert, Badge, Button, Field, Input, Select } from '@xid-kit/web-ui/ui'
 import type { BadgeTone } from '@xid-kit/web-ui/ui'
 import {

apps/console/src/routes/org/OrgAuditEvents.tsx

@@ -7,7 +7,7 @@ import { Trans, useLingui } from '@lingui/react/macro'
 import { useMemo, useState } from 'react'
 import type { ReactNode } from 'react'
 import * as stylex from '@stylexjs/stylex'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { Alert, Field, Input } from '@xid-kit/web-ui/ui'
 import {
   ConsolePage,

apps/console/src/routes/org/OrgDomains.tsx

@@ -6,7 +6,7 @@ import { Trans, useLingui } from '@lingui/react/macro'
 import { useState } from 'react'
 import type { FormEvent, ReactNode } from 'react'
 import * as stylex from '@stylexjs/stylex'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { Alert, Badge, Button, Field, Input } from '@xid-kit/web-ui/ui'
 import {
   ConsolePage,

apps/console/src/routes/org/OrgMembers.tsx

@@ -6,7 +6,7 @@ import { Trans, useLingui } from '@lingui/react/macro'
 import { useState } from 'react'
 import type { ReactNode } from 'react'
 import * as stylex from '@stylexjs/stylex'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { Alert, Badge, Button, Field, Input, Select } from '@xid-kit/web-ui/ui'
 import {
   ConsolePage,

apps/console/src/routes/org/OrgOutboundSso.tsx

@@ -6,7 +6,7 @@ import { OUTBOUND_CONSOLE_PRESETS } from '@xid-kit/protocol'
 import { useEffect, useState } from 'react'
 import type { FormEvent, ReactNode } from 'react'
 import * as stylex from '@stylexjs/stylex'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { Alert, Button, Field, Input, Select, Textarea } from '@xid-kit/web-ui/ui'
 import {
   ConsolePage,

apps/console/src/routes/org/OrgProjects.tsx

@@ -7,7 +7,7 @@ import { Trans, useLingui } from '@lingui/react/macro'
 import { useState } from 'react'
 import type { FormEvent, ReactNode } from 'react'
 import * as stylex from '@stylexjs/stylex'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { tenantManagerRoleForScope } from '@xid-kit/types'
 import { Alert, Button, Field, Input, Select } from '@xid-kit/web-ui/ui'
 import {

apps/console/src/routes/org/OrgRoles.tsx

@@ -7,7 +7,7 @@ import { Trans, useLingui } from '@lingui/react/macro'
 import { useState } from 'react'
 import type { FormEvent, ReactNode } from 'react'
 import * as stylex from '@stylexjs/stylex'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { Alert, Button, Field, Input, Select, Textarea } from '@xid-kit/web-ui/ui'
 import {
   ConsolePage,

apps/console/src/routes/org/OrgScim.tsx

@@ -14,7 +14,7 @@ import {
   ConsolePageSplitSection,
 } from '@xid-kit/web-ui/ui'
 import { DataTable } from '@xid-kit/web-ui/ui/DataTable'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { tokens } from '@xid-kit/web-ui/styles/tokens.stylex'
 import { useCreateScimDirectory, useOrgScimDirectoriesQuery, useRotateScimToken } from './queries'
 import type { ScimDirectory } from './types'

apps/console/src/routes/org/OrgScimTargets.tsx

@@ -2,7 +2,7 @@
 // 版式走 ConsolePage 骨架(web-ui):display 页头 + hairline 分节;创建/编辑表单 5/7 双列(SplitSection)。
 
 import { Trans, useLingui } from '@lingui/react/macro'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import type { FormEvent, ReactNode } from 'react'
 import { useEffect, useState } from 'react'
 import * as stylex from '@stylexjs/stylex'

apps/console/src/routes/org/OrgSso.tsx

@@ -16,7 +16,7 @@ import {
 } from '@xid-kit/web-ui/ui'
 import { DataTable } from '@xid-kit/web-ui/ui/DataTable'
 import { ConfirmDialog } from '@xid-kit/web-ui/ConfirmDialog'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { consoleShell } from '@xid-kit/web-ui/styles/product-surface.stylex'
 import {
   useCreateSsoConnection,

apps/console/src/routes/org/OrgWebhooks.tsx

@@ -8,7 +8,7 @@ import { Trans, useLingui } from '@lingui/react/macro'
 import { useState } from 'react'
 import type { FormEvent, ReactNode } from 'react'
 import * as stylex from '@stylexjs/stylex'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { Alert, Badge, Button, Field, Input } from '@xid-kit/web-ui/ui'
 import {
   ConsolePage,

apps/console/src/routes/platform/PlatformAuditEvents.tsx

@@ -7,7 +7,7 @@ import { Trans, useLingui } from '@lingui/react/macro'
 import { useState } from 'react'
 import type { FormEvent, ReactNode } from 'react'
 import * as stylex from '@stylexjs/stylex'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { Alert, Badge, Button, Field, Input } from '@xid-kit/web-ui/ui'
 import {
   ConsolePage,

apps/console/src/routes/platform/PlatformBilling.tsx

@@ -7,7 +7,7 @@ import { Trans } from '@lingui/react/macro'
 import { useState } from 'react'
 import type { ReactNode } from 'react'
 import * as stylex from '@stylexjs/stylex'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { Alert, Badge } from '@xid-kit/web-ui/ui'
 import { ConsolePage, ConsolePageNotice, ConsolePageSection } from '@xid-kit/web-ui/ui'
 import { DataTable } from '@xid-kit/web-ui/ui/DataTable'

apps/console/src/routes/platform/PlatformDeadLetters.tsx

@@ -3,7 +3,7 @@
 
 import { Trans, useLingui } from '@lingui/react/macro'
 import * as stylex from '@stylexjs/stylex'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { useMemo, useState } from 'react'
 import type { ReactNode } from 'react'
 import { Alert, Badge, Button } from '@xid-kit/web-ui/ui'

apps/console/src/routes/platform/PlatformInstanceManagers.tsx

@@ -2,7 +2,7 @@ import { Trans, useLingui } from '@lingui/react/macro'
 import { useState } from 'react'
 import type { FormEvent, ReactNode } from 'react'
 import * as stylex from '@stylexjs/stylex'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { Alert, Badge, Button, Field, Input } from '@xid-kit/web-ui/ui'
 import {
   ConsolePage,

apps/console/src/routes/platform/PlatformOrganizations.tsx

@@ -7,7 +7,7 @@ import { Trans, useLingui } from '@lingui/react/macro'
 import { useState } from 'react'
 import type { ReactNode } from 'react'
 import * as stylex from '@stylexjs/stylex'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { Alert, Badge, Button, Input } from '@xid-kit/web-ui/ui'
 import type { BadgeTone } from '@xid-kit/web-ui/ui'
 import {

apps/console/src/routes/platform/PlatformUsers.impersonation.test.tsx

@@ -4,7 +4,7 @@ import { act } from 'react'
 import { createRoot } from 'react-dom/client'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { ReactNode } from 'react'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import type { GlobalUser } from './types'
 import PlatformUsers from './PlatformUsers'
 

apps/console/src/routes/platform/PlatformUsers.tsx

@@ -7,7 +7,7 @@ import { Trans, useLingui } from '@lingui/react/macro'
 import { useState } from 'react'
 import type { ReactNode } from 'react'
 import * as stylex from '@stylexjs/stylex'
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { Alert, Badge, Button, EmptyState, Field, Input, Select } from '@xid-kit/web-ui/ui'
 import {
   ConsolePage,

apps/server/package.json

@@ -68,13 +68,13 @@
     "@stylexjs/unplugin": "catalog:",
     "@types/react": "catalog:",
     "@types/react-dom": "catalog:",
-    "@vitejs/plugin-react": "^6.0.4",
+    "@vitejs/plugin-react": "^6.0.5",
     "@xmldom/xmldom": "catalog:",
     "jsdom": "catalog:",
     "vite": "catalog:",
     "vitest": "catalog:",
     "wrangler": "catalog:",
-    "xml-core": "^1.2.5",
+    "xml-core": "^1.2.6",
     "xmldsigjs": "catalog:",
     "xpath": "^0.0.34"
   }

apps/server/src/components/ui/DataTable.test.tsx

@@ -1,4 +1,4 @@
-import type { ColumnDef } from '@tanstack/react-table'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import type { ReactNode } from 'react'
 import { renderToStaticMarkup } from 'react-dom/server'
 import { describe, expect, it, vi } from 'vitest'

apps/site/package.json

@@ -49,7 +49,7 @@
     "@tailwindcss/vite": "^4.1.4",
     "pagefind": "^1.5.2",
     "tailwindcss": "^4.1.4",
-    "textlint": "^14.0.0",
+    "textlint": "^15.8.0",
     "textlint-plugin-mdx": "^1.0.1",
     "textlint-rule-alex": "^5.0.0",
     "textlint-rule-terminology": "^5.2.0",

package.json

@@ -95,11 +95,11 @@
     "@lingui/format-po": "^6.6.0",
     "@vitest/coverage-v8": "catalog:",
     "fast-check": "^4.9.0",
-    "turbo": "^2.10.6",
+    "turbo": "^2.10.8",
     "typescript": "^6.0.3",
-    "vite-plus": "^0.2.6",
+    "vite-plus": "^0.2.8",
     "vitest": "catalog:",
-    "wrangler": "^4.114.0"
+    "wrangler": "^4.120.0"
   },
   "engines": {
     "node": ">=22.12.0"
@@ -112,7 +112,8 @@
       "sharp"
     ],
     "patchedDependencies": {
-      "@cloudflare/nimbus-docs@0.9.0": "patches/@cloudflare__nimbus-docs@0.9.0.patch"
+      "@cloudflare/nimbus-docs@0.9.0": "patches/@cloudflare__nimbus-docs@0.9.0.patch",
+      "image-size@1.2.1": "patches/image-size@1.2.1.patch"
     }
   }
 }

packages/angular/package.json

@@ -49,9 +49,9 @@
     "@xid-kit/types": "workspace:^"
   },
   "devDependencies": {
-    "@angular/common": "22.0.8",
-    "@angular/core": "22.0.8",
-    "@angular/router": "22.0.8",
+    "@angular/common": "22.1.0",
+    "@angular/core": "22.1.0",
+    "@angular/router": "22.1.0",
     "rxjs": "catalog:",
     "typescript": "catalog:",
     "vitest": "catalog:"

packages/astro/package.json

@@ -79,7 +79,7 @@
   },
   "devDependencies": {
     "@types/node": "catalog:",
-    "astro": "^7.1.3",
+    "astro": "^7.2.0",
     "typescript": "catalog:",
     "vitest": "catalog:"
   },

packages/electron/package.json

@@ -66,7 +66,7 @@
   },
   "devDependencies": {
     "@types/node": "catalog:",
-    "electron": "^42.7.1",
+    "electron": "^43.3.0",
     "typescript": "catalog:",
     "vitest": "catalog:"
   },

packages/electron/src/main/xid-app.ts

@@ -189,7 +189,13 @@ export class XidElectronApp {
   async #handleSignIn(options?: SignInOptions): Promise<string> {
     const subtle = webcrypto.subtle
     const randomValues = (arr: Uint8Array): Uint8Array => {
-      webcrypto.getRandomValues(arr)
+      // Node 26 types require Uint8Array<ArrayBuffer>; copy into a fresh buffer view.
+      const view =
+        arr.buffer instanceof ArrayBuffer
+          ? new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength)
+          : new Uint8Array(arr)
+      webcrypto.getRandomValues(view)
+      if (view !== arr) arr.set(view)
       return arr
     }