Skip to content

chore(deps): bump the npm_and_yarn group across 2 directories with 11 updates#160

Closed
dependabot[bot] wants to merge 206 commits into
masterfrom
dependabot/npm_and_yarn/apps/api/npm_and_yarn-89f3e87697
Closed

chore(deps): bump the npm_and_yarn group across 2 directories with 11 updates#160
dependabot[bot] wants to merge 206 commits into
masterfrom
dependabot/npm_and_yarn/apps/api/npm_and_yarn-89f3e87697

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 22, 2026 •
edited
Loading

Bumps the npm_and_yarn group with 1 update in the /apps/api directory: brace-expansion.
Bumps the npm_and_yarn group with 4 updates in the /trustsignal-c1 directory: @babel/runtime, next, cookie and braces.

Updates brace-expansion from 5.0.5 to 5.0.6

Commits

Updates brace-expansion from 5.0.5 to 5.0.6

Commits

Updates @babel/runtime from 7.7.2 to 7.28.4

Release notes

Sourced from @​babel/runtime's releases.

v7.28.4 (2025-09-05)

Thanks @​gwillen and @​mrginglymus for your first PRs!

🏠 Internal

Committers: 5

v7.28.3 (2025-08-14)

👓 Spec Compliance

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env

🐛 Bug Fix

💅 Polish

  • babel-plugin-transform-regenerator, babel-plugin-transform-runtime

📝 Documentation

🏠 Internal

🔬 Output optimization

  • babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions

Committers: 5

... (truncated)

Commits

Updates next from 9.3.3 to 15.5.18

Release notes

Sourced from next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

Moderate:

Low:

v15.5.16

This release contains security fixes for the following advisories:

High:

Moderate:

Low:

v15.5.15

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

v15.5.14

[!NOTE]

... (truncated)

Commits
  • 9ff92ce v15.5.18
  • 00ebe23 [backport] Disable build caches for production/staging/force-preview deploys ...
  • 62c97ab v15.5.17
  • 423623a Turbopack: Match proxy matchers with webpack implementation (#93594)
  • fa78739 Turbopack: Fix middleware matcher suffix (#93590)
  • 36e62c6 [backport] Turbopack: more strict vergen setup (#93588)
  • 36589b5 [backport][test] Pin package manager to patch versions (#93596)
  • ad6fd4e v15.5.16
  • 79d7dff Ignore malformed CSP nonce headers (#103)
  • c4f6908 router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Removes cookie

Updates next from 9.3.3 to 15.5.18

Release notes

Sourced from next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

Moderate:

Low:

v15.5.16

This release contains security fixes for the following advisories:

High:

Moderate:

Low:

v15.5.15

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

v15.5.14

[!NOTE]

... (truncated)

Commits
  • 9ff92ce v15.5.18
  • 00ebe23 [backport] Disable build caches for production/staging/force-preview deploys ...
  • 62c97ab v15.5.17
  • 423623a Turbopack: Match proxy matchers with webpack implementation (#93594)
  • fa78739 Turbopack: Fix middleware matcher suffix (#93590)
  • 36e62c6 [backport] Turbopack: more strict vergen setup (#93588)
  • 36589b5 [backport][test] Pin package manager to patch versions (#93596)
  • ad6fd4e v15.5.16
  • 79d7dff Ignore malformed CSP nonce headers (#103)
  • c4f6908 router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Updates uuid from 3.4.0 to 14.0.0

Release notes

Sourced from uuid's releases.

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

  • expect crypto to be global everywhere (requires node@20+) (#935)
  • drop node@18 support (#934)

Features

Bug Fixes

  • expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)
  • Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

  • rerelease to fix provenance. (49ccb35)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

v13.0.0

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

  • make browser exports the default (#901)

Bug Fixes

v12.0.1

12.0.1 (2026-04-29)

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.0 (2026-04-19)

Security

  • Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

  • crypto is now expected to be globally defined (requires node@20+) (#935)
  • drop node@18 support (#934)
  • upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

  • make browser exports the default (#901)

Bug Fixes

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

  • update to typescript@5.2 (#887)
  • remove CommonJS support (#886)
  • drop node@16 support (#883)

Features

Bug Fixes

11.1.0 (2025-02-19)

... (truncated)

Commits
  • 7c1ea08 chore(main): release 14.0.0 (#926)
  • 3d2c5b0 Merge commit from fork
  • f2c235f fix!: expect crypto to be global everywhere (requires node@20+) (#935)
  • 529ef08 chore: upgrade TypeScript and fixup types (#927)
  • 086fd79 chore: update dependencies (#933)
  • dc4ddb8 feat!: drop node@18 support (#934)
  • 0f1f9c9 chore: switch to Biome for parsing and linting (#932)
  • e2879e6 chore: use maintained version of npm-run-all (#930)
  • ffa3138 fix: Use GITHUB_TOKEN for release-please and enable npm provenance (#925)
  • 0423d49 docs: remove obsolete v1 option notes (#915)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates next from 9.3.3 to 15.5.18

Release notes

Sourced from next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

Moderate:

Low:

v15.5.16

This release contains security fixes for the following advisories:

High:

Moderate:

Low:

v15.5.15

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

v15.5.14

[!NOTE]

... (truncated)

Commits
  • 9ff92ce v15.5.18
  • 00ebe23 [backport] Disable build caches for production/staging/force-preview deploys ...
  • 62c97ab v15.5.17
  • 423623a Turbopack: Match proxy matchers with webpack implementation (#93594)
  • fa78739 Turbopack: Fix middleware matcher suffix (#93590)
  • 36e62c6 [backport] Turbopack: more strict vergen setup (#93588)
  • 36589b5 [backport][test] Pin package manager to patch versions (#93596)
  • ad6fd4e v15.5.16
  • 79d7dff Ignore malformed CSP nonce headers (#103)
  • c4f6908 router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Updates @babel/runtime from 7.7.2 to 7.28.4

Release notes

Sourced from @​babel/runtime's releases.

v7.28.4 (2025-09-05)

Thanks @​gwillen and @​mrginglymus for your first PRs!

🏠 Internal

Committers: 5

v7.28.3 (2025-08-14)

👓 Spec Compliance

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env

🐛 Bug Fix

💅 Polish

  • babel-plugin-transform-regenerator, babel-plugin-transform-runtime

📝 Documentation

🏠 Internal

🔬 Output optimization

  • babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions

Committers: 5

... (truncated)

Commits

Updates braces from 2.3.2 to 3.0.3

Changelog

Sourced from braces's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

  • Changelogs are for humans, not machines.
  • There should be an entry for every single version.
  • The same types of changes should be grouped.
  • Versions and sections should be linkable.
  • The latest version comes first.
  • The release date of each versions is displayed.
  • Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

  • Added for new features.
  • Changed for changes in existing functionality.
  • Deprecated for soon-to-be removed features.
  • Removed for now removed features.
  • Fixed for any bug fixes.
  • Security in case of vulnerabilities.

[3.0.0] - 2018-04-08

v3.0 is a complete refactor, resulting in a faster, smaller codebase, with fewer deps, and a more accurate parser and compiler.

Breaking Changes

  • The undocumented .makeRe method was removed
  • Require Node.js >= 8.3

Non-breaking changes

  • Caching was removed
Commits

Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates mermaid from 11.12.2 to 11.15.0

Release notes

Sourced from mermaid's releases.

mermaid@11.15.0

Minor Changes

  • #7174 0aca217 Thanks @​milesspencer35! - feat(sequence): Add support for decimal start and increment values in the autonumber directive

  • #7512 8e17492 Thanks @​aruncveli! - feat(flowchart): add datastore shape

    In Data flow diagrams, a datastore/warehouse/file/database is used to represent data persistence. It is denoted by a rectangle with only top and bottom borders, and can be used in flowcharts with A@{ shape: datastore, label: "Datastore" }.

  • #6440 9ad8dde Thanks @​yordis, @​lgazo! - feat: add Event Modeling diagram

  • #7707 27db774 Thanks @​txmxthy! - feat(architecture): expose four fcose layout knobs for architecture-beta diagrams (nodeSeparation, idealEdgeLengthMultiplier, edgeElasticity, numIter) so authors can tune layout density and spread overlapping siblings without changing diagram source

  • #7604 bf9502f Thanks @​M-a-c! - feat(class): add nested namespace support for class diagrams via dot notation and syntactic nesting

    If you have namespaces in class diagrams that use .s already and want to render them without nesting (≤v11.14.0 behaviour), you can use set class.hierarchicalNamespaces=false in your mermaid config:

    config:
  class:
    hierarchicalNamespaces: false

  • #7272 88cdd3d Thanks @​xinbenlv! - feat(sankey): add outlined label style, configurable nodeWidth/nodePadding, and custom node colors

Patch Changes

  • #7737 e9b0f34 Thanks @​ashishjain0512! - fix: prevent unbalanced CSS styles in classDefs

  • #7737 37ff937 Thanks @​ashishjain0512! - fix: create CSS styles using the CSSOM

    This removes some invalid CSS and normalizes some CSS formatting.

  • #7508 bfe60cc Thanks @​biiab! - fix(stateDiagram): end note now only closes a note when used on a new line

  • #7737 faafb5d Thanks @​ashishjain0512! - fix(gantt): add iteration limit for excludes field

  • #7737 65f8be2 Thanks @​ashishjain0512! - fix: disallow some CSS at-rules in custom CSS

  • #7726 1502f32 Thanks @​aloisklink! - fix(wardley): fix unnecessary sanitization of text

  • #7578 1f98db8 Thanks @​Gaston202! - fix(class): self-referential class multiplicity labels no longer rendered multiple times

    Fixes #7560. Resolves an issue where cardinality labels on self-referential class relationships were rendered three times due to edge splitting in the dagre layout. The fix ensures that each sub-edge only carries its relevant label positions.

  • #7592 2343e38 Thanks @​knsv-bot! - fix(sequence): add background box behind alt/else section title labels in sequence diagrams

chrismaz11 added 30 commits March 2, 2026 17:30
@chrismaz11
Merge branch 'master' into work
79f32e9
@chrismaz11
docs(rebrand): standardize on TrustSignal brand, deprecate DeedShield…
1139f38 
… references in user-facing docs
@chrismaz11
Add landing pricing and CTA
58cee75
@chrismaz11
Fix CSS overflow and contrast
3f7bd7e
@chrismaz11
fix(web): prevent mobile text overflow and raise dark-theme readability
234d615 
Ensure critical fraud-prevention and policy text remains visible on small screens by tightening overflow and wrap rules.

Increase dark-surface label/footnote font floors and contrast to reduce misread risk for security-relevant claims and disclosures.
@chrismaz11
chore: remove committed log file
1d42a5b
@chrismaz11
feat(integrations): add Vanta-ready API outputs and compliance eviden…
db288a2 
…ce docs

Security: adds schema-validated integration payloads to reduce ingestion ambiguity and keeps restrictive proprietary licensing to prevent unauthorized redistribution.
@chrismaz11
fix(api): secure Vercel subdomain runtime and fail safely on missing DB
0b24db6
@chrismaz11
feat(partnership): add Vanta demo package and harden API surface
37cb532 
Add partnership collateral, demo UI, and webhook simulation scripts for the 2026-03-06 Vanta integration call.

Security: add strict HTTP security headers in vercel.api.json and reduce dependency attack surface by removing unused PDF and desktop notifier packages from production web dependencies.
@chrismaz11
chore(repo): remove deed shield submodule and normalize docs
d0dd7e5 
Remove the Deed_Shield git submodule from repository tracking and clean up stale documentation references to the old submodule layout.

Security: reduces repository complexity and eliminates stale path references that could cause incorrect operational/security evidence mapping during audits.
@chrismaz11
feat(api): enforce primary-source registry guardrails
00264c3
@chrismaz11
chore(security): bump fastify to 5.8.1 across workspaces
18acb71
@chrismaz11
Merge pull request #7 from chrismaz11/cm/feature/vanta-integration-demo
86996b9 
chore(security): bump Fastify to 5.8.1 to remediate CVE-2026-3419
@chrismaz11
feat: mvp10 registries
e6b1d1e
@chrismaz11
feat: mvp10 registries
1182ad6
@chrismaz11
chore: add primary-source guardrails and fail-closed registry artifacts
227a55c
@chrismaz11
Merge pull request #8 from chrismaz11/cm/feature/vanta-integration-demo
c5917bd 
feat: complete MVP10 registry hardening artifacts
@chrismaz11
chore: consolidate test roots and refresh blockers
cf86dc1
@chrismaz11
chore(governance): import db security docs and validation tests
ffe7d73
@chrismaz11
Merge pull request #9 from chrismaz11/chore/governance-cherrypick
f12f6c7 
chore(governance): import db security docs and validation tests
@chrismaz11
docs: import passive inspector and operational training manuals
331981c
@chrismaz11
halo2
95c87ba
@chrismaz11
Add Codex guardrails and compliance CI checks
227dc09
@chrismaz11
test(zkp): align external prover fixture with ndjson protocol
10f6894
@chrismaz11
docs(governance): capture green checks and approval-gated merge status
f6d2057
@chrismaz11
docs(governance): update evidence to latest passing PR run
566b8b5
@chrismaz11
chore(governance): consolidate verified controls onto halo2 baseline
406a6ce
@chrismaz11
fix(ci): unblock actions with license-free scans and rust test repair
f5ec156
@chrismaz11
fix(test): make CI independent of optional db and ezkl bindings
83942d4
@chrismaz11
fix(test): stabilize legacy route auth coverage in CI
34fb98f
dependabot Bot and others added 19 commits May 10, 2026 15:24
@dependabot @chrismaz11
chore(deps): bump dotenv from 17.2.3 to 17.4.2 (#135)
4164b36 
Bumps [dotenv](https://github.com/motdotla/dotenv) from 17.2.3 to 17.4.2.
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v17.2.3...v17.4.2)

---
updated-dependencies:
- dependency-name: dotenv
  dependency-version: 17.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: chrismaz11 <chrismaz11@me.com>
@dependabot @chrismaz11
chore(deps-dev): bump jsdom from 26.1.0 to 29.1.1 (#134)
1bfc405 
Bumps [jsdom](https://github.com/jsdom/jsdom) from 26.1.0 to 29.1.1.
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v26.1.0...v29.1.1)

---
updated-dependencies:
- dependency-name: jsdom
  dependency-version: 29.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: chrismaz11 <chrismaz11@me.com>
@dependabot @chrismaz11
chore(deps): bump rand (#137)
dc60e26 
Bumps the cargo group with 1 update in the /circuits/non_mem_gadget directory: [rand](https://github.com/rust-random/rand).


Updates `rand` from 0.8.5 to 0.8.6
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.8.6/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.5...0.8.6)

---
updated-dependencies:
- dependency-name: rand
  dependency-version: 0.8.6
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: chrismaz11 <chrismaz11@me.com>
@dependabot @chrismaz11
chore(deps): bump actions/setup-node from 4 to 6 (#131)
7fb9716 
* chore(deps): bump actions/setup-node from 4 to 6

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* ci: unblock PR checks by hardening review and consistency gates

* ci: use node 20.20.2 and localize repo-consistency scans

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: chris <chris@chriss-MacBook-Neo.local>
Co-authored-by: chrismaz11 <chrismaz11@me.com>
@chrismaz11 @github-advanced-security
feat(epc): EPC integration foundation (#150)
527ef27 
* ci: unblock PR checks by hardening review and consistency gates

* security: reduce code scanning findings in workflows and API key hashing

* security: add .secrets/ to .gitignore to prevent private key exposure

* fix: align test suite to current API contract and auth env naming

* fix: restore accidentally deleted .gitignore entries

* feat(epc): EPC integration foundation — OAuth2, transaction model, origin endpoint, webhook receiver, credential storage, 19/19 tests passing

* merge: resolve master conflicts for EPC foundation

Agent-Logs-Url: https://github.com/TrustSignal-dev/TrustSignal/sessions/dd19a24a-8ea9-4b0b-9cef-f07d4c19924b

Co-authored-by: chrismaz11 <24700273+chrismaz11@users.noreply.github.com>

* chore: align setup-node pin comments

Agent-Logs-Url: https://github.com/TrustSignal-dev/TrustSignal/sessions/dd19a24a-8ea9-4b0b-9cef-f07d4c19924b

Co-authored-by: chrismaz11 <24700273+chrismaz11@users.noreply.github.com>

* Potential fix for pull request finding 'CodeQL / Use of password hash with insufficient computational effort'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* fix(epc): address PR #150 review comments

- credentials.ts: add AUTH_TAG_LENGTH guard in decryptCredential
- origin.ts: use Prisma P2002 error code instead of brittle message match
- webhook.ts: import Prisma; add P2002 catch to handle concurrent duplicate deliveries
- schema.prisma: add @unique to EpcWebhookLog.elliSignature
- migration.sql: add UNIQUE INDEX on EpcWebhookLog.elliSignature
- server.ts: capture raw body via addContentTypeParser before JSON parse
  so HMAC verification in webhook handler uses exact bytes
- tests/epc/origin.test.ts: update duplicate test to throw PrismaClientKnownRequestError P2002

All 19 EPC tests passing. UNIQUE index applied to Supabase.

* fix(lint): suppress no-explicit-any for Fastify rawBody and fix import order in origin test

---------

Co-authored-by: chris <chris@chriss-MacBook-Neo.local>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: chrismaz11 <24700273+chrismaz11@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@christophermarziani21-spec
chore: trigger vercel production deploy
de9d8d4
@christophermarziani21-spec
fix(deploy): update DATABASE_URL env var in production
6e44ce2
@christophermarziani21-spec
fix(deploy): fix JWK env var encoding in production
fa9145b
@christophermarziani21-spec
fix(auth): ensure TRUSTSIGNAL_API_KEY_HASH_SECRET is set correctly
1889896
@christophermarziani21-spec
feat: integrate CredentialFraudCNN-v1.0 for non-deed verticals
8aaf201 
- Added CredentialFraudCNN training and compilation pipeline in ml/credential_zkml/
- Updated packages/core/src/zkml/index.ts to support the new model ID and artifacts
- Expanded apps/api/src/server.ts feature extraction to 3076 dimensions
- Added small ZK artifacts (vk, compiled) to ml/zkml/
- Ignored large proving keys (.pk) in .gitignore
@christophermarziani21-spec
chore: add ezkl execution shims for local production environment
e984b07
@christophermarziani21-spec
feat: complete end-to-end zkML + TSA pipeline
a375dea 
- Integrated RFC 3161 TSA timestamping into receipt issuance
- Updated Prisma schema with tsaToken and tsaUrl fields
- Updated V2 response mapper to include TSA metadata
- Bypassed PostgreSQL-specific schema assertion for local dev compatibility
@christophermarziani21-spec
chore: rename deed_cnn artifacts to credential_cnn
bc59a96
@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 10 u…
3a4226c 
…pdates (#157)
@christophermarziani21-spec
fix: restore 3076-dim credential_cnn artifacts, resync ZKML pipeline
118a748
@christophermarziani21-spec @claude
feat: hybrid standard verification + independent fraud scan pipeline
41faf7d 
Implements the full hybrid architecture with all 9 corrections applied:

Standard Verification produces the binding compliance decision (ALLOW/FLAG/BLOCK).
Independent Fraud Scan runs as a completely separate pipeline — its result is
advisory only and NEVER modifies verification.decision, .reasons, or .checks.

Key changes:
- API (server.ts): fraud_scan Zod opt-in field, FraudScanResult type,
  RISK_ENGINE_VERSION constant, gated by TenantConfig.fraudScanEnabled
  (+ dev-mode bypass), issueReceiptRecord accepts fraudScan struct
- Response mapper (v2ReceiptMapper.ts): standard_verification + fraud_scan
  sub-objects; backward-compat fraudRisk alias retained
- discard_audit_log: extractorVersion and vectorSimilarity now populated
  from the fraud scan result (were null)
- Core types (packages/core/src/types.ts): FraudScan, StandardVerification
  types; fraudScan? on UnsignedReceiptPayload
- Prisma: TenantConfig model + migration; DiscardAuditLog + RLS migration
- New service: apps/api/src/services/tenantConfig.ts
- New package: packages/trustsignal-extractor — ExtractorClient with full
  typed hybrid request/response shapes
- SDK (sdk/index.ts): StandardVerification, FraudScan types; VerifyInput
  and VerifyResponse updated for hybrid contract
- Setup CLI (trustsignal-setup): Step 5 fraud scan prompt; config.json
  includes fraudScanEnabled; summary prints scan status
- Docs: wiki/API-Overview.md hybrid model section with request/response examples
- Tests: v2-integration.test.ts opts in to fraud scan, asserts all hybrid fields
- e2e script: prints standard_verification + fraud_scan in step 1 output

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@christophermarziani21-spec
fix: resolve lint errors in trustsignal-setup
599472e
@christophermarziani21-spec
fix: resolve high CVE in @solana/web3.js, move vercel to devDependencies
d60fd96
@dependabot
chore(deps): bump the npm_and_yarn group across 2 directories with 11…
9445ac1 
… updates

Bumps the npm_and_yarn group with 1 update in the /apps/api directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Bumps the npm_and_yarn group with 4 updates in the /trustsignal-c1 directory: [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime), [next](https://github.com/vercel/next.js), [cookie](https://github.com/jshttp/cookie) and [braces](https://github.com/micromatch/braces).


Updates `brace-expansion` from 5.0.5 to 5.0.6
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.6)

Updates `brace-expansion` from 5.0.5 to 5.0.6
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.6)

Updates `@babel/runtime` from 7.7.2 to 7.28.4
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.28.4/packages/babel-runtime)

Updates `next` from 9.3.3 to 15.5.18
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v9.3.3...v15.5.18)

Removes `cookie`

Updates `next` from 9.3.3 to 15.5.18
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v9.3.3...v15.5.18)

Updates `uuid` from 3.4.0 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v3.4.0...v14.0.0)

Updates `next` from 9.3.3 to 15.5.18
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v9.3.3...v15.5.18)

Updates `@babel/runtime` from 7.7.2 to 7.28.4
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.28.4/packages/babel-runtime)

Updates `braces` from 2.3.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/braces/commits/3.0.3)

Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

Updates `mermaid` from 11.12.2 to 11.15.0
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.12.2...mermaid@11.15.0)

Updates `micromatch` from 3.1.10 to 4.0.8
- [Release notes](https://github.com/micromatch/micromatch/releases)
- [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/micromatch@3.1.10...4.0.8)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `postcss` from 7.0.21 to 8.4.31
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@7.0.21...8.4.31)

Updates `uuid` from 3.4.0 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v3.4.0...v14.0.0)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 5.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@babel/runtime"
  dependency-version: 7.28.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.18
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: cookie
  dependency-version:
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.18
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: uuid
  dependency-version: 14.0.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.18
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@babel/runtime"
  dependency-version: 7.28.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-version: 3.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: mermaid
  dependency-version: 11.15.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: micromatch
  dependency-version: 4.0.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.4.31
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: uuid
  dependency-version: 14.0.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency updates or package management work. javascript Pull requests that update javascript code labels May 22, 2026
@vercel
Copy link
Copy Markdown

vercel Bot commented May 22, 2026

Unable to deploy a commit from a private repository on your GitHub organization to the Christopher Marziani's projects team on Vercel, which is currently on the Hobby plan. In order to deploy, you can:

  • Make your repository public or
  • Upgrade to Pro. A Pro subscription is required to deploy from a private organization repository.

To read more about collaboration on Vercel, click here.

@dependabot dependabot Bot added dependencies Dependency updates or package management work. javascript Pull requests that update javascript code labels May 22, 2026
@chatgpt-codex-connector
Copy link
Copy Markdown

chatgpt-codex-connector Bot commented May 22, 2026

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

@vercel
Copy link
Copy Markdown

vercel Bot commented May 22, 2026

Deployment failed with the following error:

The provided GitHub repository does not contain the requested branch or commit reference. Please ensure the repository is not empty.

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 24, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this May 24, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/apps/api/npm_and_yarn-89f3e87697 branch May 24, 2026 03:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Dependency updates or package management work. javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@chrismaz11 @christophermarziani21-spec