fix: resolve dependabot security alerts and fix templates for toml 4

Dependencies: - app: react-router-dom ^7.18.0, vite ^6.4.3, yaml 2.8.3 - app (transitive, lockfile only): postcss 8.5.28, nanoid 3.3.19, picomatch 2.3.2/4.0.7, browserslist 4.29.2, rollup 4.63.5, @babel/core 7.29.7, @babel/runtime 7.29.7 - build-scripts: toml 4.2.0 (matches Dokploy/dokploy#5517), yaml 2.8.3 Templates rejected by toml 4's strict parsing (Dokploy fetches template.toml from this repo at runtime, so they would fail there once #5517 ships): - signoz, supabase: write invalid escape sequences (\{ \$ \( \s ...) as \\ so the parsed value keeps the literal backslash exactly as toml 3 produced it - timescaledb, valkey: drop `mounts = []` redefined by [[config.mounts]] Parsed output is deep-equal to before under toml 3 for all 532 templates.
2026-11-11 13:38:07 -06:00 · 2026-09-29 11:12:00 -04:00
14 changed files with 388 additions and 605 deletions
@@ -35,13 +35,13 @@
    "next-themes": "^0.4.6",
    "react": "^19.2.0",
    "react-dom": "^19.2.0",
-    "react-router-dom": "^7.9.4",
+    "react-router-dom": "^7.18.0",
    "sonner": "^2.0.7",
    "tailwind-merge": "^3.3.1",
    "tailwindcss": "^4.1.16",
    "tailwindcss-animate": "^1.0.7",
    "vite-plugin-static-copy": "^2.3.2",
-    "yaml": "2.7.1",
+    "yaml": "2.8.3",
    "zustand": "^5.0.8"
  },
  "devDependencies": {
@@ -51,6 +51,6 @@
    "@vitejs/plugin-react": "^4.7.0",
    "globals": "^15.15.0",
    "typescript": "~5.7.3",
-    "vite": "^6.4.1"
+    "vite": "^6.4.3"
  }
 }
@@ -1,230 +0,0 @@
-services:
-  postgres:
-    image: postgres:18-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15
-    environment:
-      POSTGRES_USER: orbit
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?required}
-      POSTGRES_DB: orbit
-    volumes:
-    - postgres:/var/lib/postgresql
-    healthcheck:
-      test:
-      - CMD-SHELL
-      - pg_isready -U orbit -d orbit
-      interval: 5s
-      timeout: 3s
-      retries: 20
-    restart: unless-stopped
-  redis:
-    image: redis:8-alpine@sha256:978f0e01593e65eed801f2402944efcd936d43b5027e4908a7897baf88ed6241
-    command:
-    - redis-server
-    - --appendonly
-    - 'yes'
-    volumes:
-    - redis:/data
-    healthcheck:
-      test:
-      - CMD
-      - redis-cli
-      - ping
-      interval: 5s
-      timeout: 3s
-      retries: 20
-    restart: unless-stopped
-  storage:
-    # SeaweedFS S3 gateway (MinIO images are no longer publicly pullable).
-    image: chrislusf/seaweedfs:4.48
-    entrypoint:
-    - /bin/sh
-    - -c
-    command:
-    - |
-      set -e
-      printf '{"identities":[{"name":"orbit","credentials":[{"accessKey":"orbit","secretKey":"%s"}],"actions":["Admin","Read","Write","List","Tagging"]}]}' "$$MINIO_PASSWORD" > /tmp/s3.json
-      exec weed server -dir=/data -ip.bind=0.0.0.0 -s3 -s3.port=9000 -s3.config=/tmp/s3.json
-    environment:
-      MINIO_PASSWORD: ${MINIO_PASSWORD:?required}
-    volumes:
-    - storage:/data
-    healthcheck:
-      test:
-      - CMD-SHELL
-      - wget -q -O /dev/null http://127.0.0.1:9000/healthz || exit 1
-      interval: 5s
-      timeout: 3s
-      retries: 30
-    restart: unless-stopped
-    expose:
-    - '9000'
-  bucket:
-    # Reuses the mc client from orbit-bucket to create the bucket and its CORS rule on SeaweedFS.
-    image: ghcr.io/noveum/orbit-bucket:2026.09.24
-    entrypoint:
-    - /bin/sh
-    - -c
-    command:
-    - |
-      set -eu
-      until mc alias set orbit http://storage:9000 orbit "$$MINIO_PASSWORD" --api S3v4; do sleep 2; done
-      until mc mb --ignore-existing orbit/orbit-uploads; do sleep 2; done
-      printf '<CORSConfiguration><CORSRule><AllowedOrigin>%s</AllowedOrigin><AllowedMethod>GET</AllowedMethod><AllowedMethod>PUT</AllowedMethod><AllowedMethod>HEAD</AllowedMethod><AllowedHeader>*</AllowedHeader><ExposeHeader>ETag</ExposeHeader><MaxAgeSeconds>3600</MaxAgeSeconds></CORSRule></CORSConfiguration>' "$$ORBIT_APP_URL" > /tmp/cors.xml
-      until mc cors set orbit/orbit-uploads /tmp/cors.xml; do sleep 2; done
-      touch /tmp/initialized
-      exec tail -f /dev/null
-    environment:
-      MINIO_PASSWORD: ${MINIO_PASSWORD:?required}
-      ORBIT_APP_URL: ${ORBIT_APP_URL:?required}
-    depends_on:
-      storage:
-        condition: service_healthy
-    restart: unless-stopped
-    healthcheck:
-      test:
-      - CMD-SHELL
-      - test -f /tmp/initialized
-      interval: 5s
-      timeout: 3s
-      retries: 30
-  web:
-    image: ghcr.io/noveum/orbit-runtime:2026.09.24
-    environment:
-      DATABASE_URL: postgres://orbit:${POSTGRES_PASSWORD:?required}@postgres:5432/orbit
-      DIRECT_URL: postgres://orbit:${POSTGRES_PASSWORD:?required}@postgres:5432/orbit
-      DATABASE_PREPARED_STATEMENTS: 'true'
-      REDIS_URL: redis://redis:6379
-      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET:?required}
-      BETTER_AUTH_URL: ${ORBIT_APP_URL:?required}
-      NEXT_PUBLIC_APP_URL: ${ORBIT_APP_URL:?required}
-      ORBIT_PASSWORD_AUTH: ${ORBIT_PASSWORD_AUTH:-true}
-      ALLOWED_EMAIL_DOMAINS: ${ALLOWED_EMAIL_DOMAINS:-}
-      RESEND_API_KEY: ${RESEND_API_KEY:-}
-      EMAIL_FROM: ${EMAIL_FROM:-Orbit <auth@orbit.local>}
-      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
-      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
-      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:-}
-      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:-}
-      GITHUB_APP_SLUG: ${GITHUB_APP_SLUG:-}
-      GITHUB_APP_ID: ${GITHUB_APP_ID:-}
-      GITHUB_APP_PRIVATE_KEY: ${GITHUB_APP_PRIVATE_KEY:-}
-      GITHUB_APP_CLIENT_ID: ${GITHUB_APP_CLIENT_ID:-}
-      GITHUB_APP_CLIENT_SECRET: ${GITHUB_APP_CLIENT_SECRET:-}
-      GITHUB_WEBHOOK_SECRET: ${GITHUB_WEBHOOK_SECRET:-}
-      SLACK_ENABLED: ${SLACK_ENABLED:-false}
-      SLACK_CLIENT_ID: ${SLACK_CLIENT_ID:-}
-      SLACK_CLIENT_SECRET: ${SLACK_CLIENT_SECRET:-}
-      SLACK_SIGNING_SECRET: ${SLACK_SIGNING_SECRET:-}
-      SLACK_APP_ID: ${SLACK_APP_ID:-}
-      CRON_SECRET: ${CRON_SECRET:-}
-      ORBIT_SELF_HOSTED: 'true'
-      S3_ENDPOINT: ${ORBIT_STORAGE_URL:?required}
-      S3_REGION: us-east-1
-      S3_BUCKET: orbit-uploads
-      S3_ACCESS_KEY_ID: orbit
-      S3_SECRET_ACCESS_KEY: ${MINIO_PASSWORD:?required}
-      NEXT_TELEMETRY_DISABLED: '1'
-    healthcheck:
-      test:
-      - CMD
-      - node
-      - -e
-      - fetch('http://127.0.0.1:3000/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))
-      interval: 10s
-      timeout: 5s
-      start_period: 30s
-      retries: 5
-    depends_on:
-      postgres:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-      bucket:
-        condition: service_healthy
-    restart: unless-stopped
-  realtime:
-    image: ghcr.io/noveum/orbit-runtime:2026.09.24
-    command:
-    - node
-    - apps/web/realtime.mjs
-    environment:
-      DATABASE_URL: postgres://orbit:${POSTGRES_PASSWORD:?required}@postgres:5432/orbit
-      DIRECT_URL: postgres://orbit:${POSTGRES_PASSWORD:?required}@postgres:5432/orbit
-      DATABASE_PREPARED_STATEMENTS: 'true'
-      REDIS_URL: redis://redis:6379
-      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET:?required}
-      BETTER_AUTH_URL: ${ORBIT_APP_URL:?required}
-      NEXT_PUBLIC_APP_URL: ${ORBIT_APP_URL:?required}
-      ORBIT_PASSWORD_AUTH: ${ORBIT_PASSWORD_AUTH:-true}
-      ALLOWED_EMAIL_DOMAINS: ${ALLOWED_EMAIL_DOMAINS:-}
-      RESEND_API_KEY: ${RESEND_API_KEY:-}
-      EMAIL_FROM: ${EMAIL_FROM:-Orbit <auth@orbit.local>}
-      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
-      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
-      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:-}
-      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:-}
-      GITHUB_APP_SLUG: ${GITHUB_APP_SLUG:-}
-      GITHUB_APP_ID: ${GITHUB_APP_ID:-}
-      GITHUB_APP_PRIVATE_KEY: ${GITHUB_APP_PRIVATE_KEY:-}
-      GITHUB_APP_CLIENT_ID: ${GITHUB_APP_CLIENT_ID:-}
-      GITHUB_APP_CLIENT_SECRET: ${GITHUB_APP_CLIENT_SECRET:-}
-      GITHUB_WEBHOOK_SECRET: ${GITHUB_WEBHOOK_SECRET:-}
-      SLACK_ENABLED: ${SLACK_ENABLED:-false}
-      SLACK_CLIENT_ID: ${SLACK_CLIENT_ID:-}
-      SLACK_CLIENT_SECRET: ${SLACK_CLIENT_SECRET:-}
-      SLACK_SIGNING_SECRET: ${SLACK_SIGNING_SECRET:-}
-      SLACK_APP_ID: ${SLACK_APP_ID:-}
-      CRON_SECRET: ${CRON_SECRET:-}
-      ORBIT_SELF_HOSTED: 'true'
-      S3_ENDPOINT: ${ORBIT_STORAGE_URL:?required}
-      S3_REGION: us-east-1
-      S3_BUCKET: orbit-uploads
-      S3_ACCESS_KEY_ID: orbit
-      S3_SECRET_ACCESS_KEY: ${MINIO_PASSWORD:?required}
-      NEXT_TELEMETRY_DISABLED: '1'
-    healthcheck:
-      test:
-      - CMD
-      - node
-      - -e
-      - fetch('http://127.0.0.1:3100/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    depends_on:
-      web:
-        condition: service_healthy
-      bucket:
-        condition: service_healthy
-    restart: unless-stopped
-  scheduler:
-    image: ghcr.io/noveum/orbit-runtime:2026.09.24
-    command:
-    - node
-    - apps/web/scheduler.mjs
-    environment:
-      CRON_SECRET: ${CRON_SECRET:?required}
-      ORBIT_INTERNAL_URL: http://web:3000
-    stop_grace_period: 310s
-    depends_on:
-      web:
-        condition: service_healthy
-    restart: unless-stopped
-  orbit:
-    image: ghcr.io/noveum/orbit-gateway:2026.09.24
-    environment:
-      ORBIT_TRUSTED_PROXIES: ${ORBIT_TRUSTED_PROXIES:-private_ranges}
-    depends_on:
-      web:
-        condition: service_healthy
-      realtime:
-        condition: service_healthy
-      scheduler:
-        condition: service_started
-    restart: unless-stopped
-    expose:
-    - '3000'
-volumes:
-  postgres: null
-  redis: null
-  storage: null
-version: '3.8'
@@ -1,13 +0,0 @@
-# Orbit by Noveum
-
-Deploy, then enable HTTPS with a valid certificate for both generated domains
-in Dokploy's Domains tab. Open the Orbit HTTPS domain and create your account
-and workspace. Both the app and storage domains require working HTTPS. Database migrations,
-bucket creation and the storage CORS allowlist are configured automatically.
-PostgreSQL, Redis and SeaweedFS (S3 storage) use persistent volumes. Preserve generated secrets
-and back up PostgreSQL and the SeaweedFS storage volume before upgrades. Run one scheduler instance.
-Configure Resend and EMAIL_FROM on web to send invitations and password recovery.
-Configure ALLOWED_EMAIL_DOMAINS to restrict signup to your team.
-
-Hosted MCP: https://orbit.noveum.ai/mcp
-Self-hosted MCP: your Orbit HTTPS domain followed by /mcp.
@@ -1,18 +0,0 @@
-{
-  "id": "orbit",
-  "name": "Orbit by Noveum",
-  "version": "2026.09.24",
-  "description": "Open-source task management with issues, projects, sprints, docs, files, realtime collaboration and an OAuth MCP endpoint.",
-  "logo": "orbit.png",
-  "links": {
-    "github": "https://github.com/Noveum/orbit",
-    "website": "https://orbit.noveum.ai",
-    "docs": "https://github.com/Noveum/orbit/blob/containers-2026.09.24/docs/container-catalogs.md"
-  },
-  "tags": [
-    "productivity",
-    "project-management",
-    "collaboration",
-    "mcp"
-  ]
-}
@@ -1,27 +0,0 @@
-[variables]
-main_domain = "${domain}"
-storage_domain = "${domain}"
-postgres_password = "${password:48}"
-minio_password = "${password:48}"
-auth_secret = "${password:64}"
-cron_secret = "${password:64}"
-
-[config]
-env = [
-  "ORBIT_APP_URL=https://${main_domain}",
-  "ORBIT_STORAGE_URL=https://${storage_domain}",
-  "POSTGRES_PASSWORD=${postgres_password}",
-  "MINIO_PASSWORD=${minio_password}",
-  "BETTER_AUTH_SECRET=${auth_secret}",
-  "CRON_SECRET=${cron_secret}",
-]
-
-[[config.domains]]
-serviceName = "orbit"
-port = 3000
-host = "${main_domain}"
-
-[[config.domains]]
-serviceName = "storage"
-port = 9000
-host = "${storage_domain}"
@@ -472,7 +472,7 @@ content = """
                <my_ad_server>
                    <host>localhost</host>
                    <port>389</port>
-                    <bind_dn>EXAMPLE\{user_name}</bind_dn>
+                    <bind_dn>EXAMPLE\\{user_name}</bind_dn>
                    <user_dn_detection>
                        <base_dn>CN=Users,DC=example,DC=com</base_dn>
                        <search_filter>(&amp;(objectClass=user)(sAMAccountName={user_name}))</search_filter>
@@ -624,14 +624,14 @@ content = """
         To install and run JDBC bridge in background:
         * [Debian/Ubuntu]
           export MVN_URL=https://repo1.maven.org/maven2/ru/yandex/clickhouse/clickhouse-jdbc-bridge
-           export PKG_VER=$(curl -sL $MVN_URL/maven-metadata.xml | grep '<release>' | sed -e 's|.*>\(.*\)<.*|\1|')
+           export PKG_VER=$(curl -sL $MVN_URL/maven-metadata.xml | grep '<release>' | sed -e 's|.*>\\(.*\\)<.*|\\1|')
           wget https://github.com/ClickHouse/clickhouse-jdbc-bridge/releases/download/v$PKG_VER/clickhouse-jdbc-bridge_$PKG_VER-1_all.deb
           apt install --no-install-recommends -f ./clickhouse-jdbc-bridge_$PKG_VER-1_all.deb
           clickhouse-jdbc-bridge &

         * [CentOS/RHEL]
           export MVN_URL=https://repo1.maven.org/maven2/ru/yandex/clickhouse/clickhouse-jdbc-bridge
-           export PKG_VER=$(curl -sL $MVN_URL/maven-metadata.xml | grep '<release>' | sed -e 's|.*>\(.*\)<.*|\1|')
+           export PKG_VER=$(curl -sL $MVN_URL/maven-metadata.xml | grep '<release>' | sed -e 's|.*>\\(.*\\)<.*|\\1|')
           wget https://github.com/ClickHouse/clickhouse-jdbc-bridge/releases/download/v$PKG_VER/clickhouse-jdbc-bridge-$PKG_VER-1.noarch.rpm
           yum localinstall -y clickhouse-jdbc-bridge-$PKG_VER-1.noarch.rpm
           clickhouse-jdbc-bridge &
@@ -1068,11 +1068,11 @@ content = """
    <query_masking_rules>
        <rule>
            <name>hide encrypt/decrypt arguments</name>
-            <regexp>((?:aes_)?(?:encrypt|decrypt)(?:_mysql)?)\s*\(\s*(?:'(?:\\'|.)+'|.*?)\s*\)</regexp>
+            <regexp>((?:aes_)?(?:encrypt|decrypt)(?:_mysql)?)\\s*\\(\\s*(?:'(?:\\'|.)+'|.*?)\\s*\\)</regexp>
            <!-- or more secure, but also more invasive:
-                (aes_\w+)\s*\(.*\)
+                (aes_\\w+)\\s*\\(.*\\)
            -->
-            <replace>\1(???)</replace>
+            <replace>\\1(???)</replace>
        </rule>
    </query_masking_rules>

@@ -213,17 +213,17 @@ content = """#!/bin/bash
 # and performs environment variable substitution in the declarative config.

 if [ -n "$SUPABASE_SECRET_KEY" ] && [ -n "$SUPABASE_PUBLISHABLE_KEY" ]; then
-    export LUA_AUTH_EXPR="\$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) or (headers.apikey == '$SUPABASE_SECRET_KEY' and 'Bearer $SERVICE_ROLE_KEY_ASYMMETRIC') or (headers.apikey == '$SUPABASE_PUBLISHABLE_KEY' and 'Bearer $ANON_KEY_ASYMMETRIC') or headers.apikey)"
-    export LUA_RT_WS_EXPR="\$((query_params.apikey == '$SUPABASE_SECRET_KEY' and '$SERVICE_ROLE_KEY_ASYMMETRIC') or (query_params.apikey == '$SUPABASE_PUBLISHABLE_KEY' and '$ANON_KEY_ASYMMETRIC') or query_params.apikey)"
+    export LUA_AUTH_EXPR="\\$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) or (headers.apikey == '$SUPABASE_SECRET_KEY' and 'Bearer $SERVICE_ROLE_KEY_ASYMMETRIC') or (headers.apikey == '$SUPABASE_PUBLISHABLE_KEY' and 'Bearer $ANON_KEY_ASYMMETRIC') or headers.apikey)"
+    export LUA_RT_WS_EXPR="\\$((query_params.apikey == '$SUPABASE_SECRET_KEY' and '$SERVICE_ROLE_KEY_ASYMMETRIC') or (query_params.apikey == '$SUPABASE_PUBLISHABLE_KEY' and '$ANON_KEY_ASYMMETRIC') or query_params.apikey)"
 else
-    export LUA_AUTH_EXPR="\$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) or headers.apikey)"
-    export LUA_RT_WS_EXPR="\$(query_params.apikey)"
+    export LUA_AUTH_EXPR="\\$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) or headers.apikey)"
+    export LUA_RT_WS_EXPR="\\$(query_params.apikey)"
 fi

 awk '{
  result = ""
  rest = $0
-  while (match(rest, /\$[A-Za-z_][A-Za-z_0-9]*/)) {
+  while (match(rest, /\\$[A-Za-z_][A-Za-z_0-9]*/)) {
    varname = substr(rest, RSTART + 1, RLENGTH - 1)
    if (varname in ENVIRON) {
      result = result substr(rest, 1, RSTART - 1) ENVIRON[varname]
@@ -5,7 +5,6 @@ postgres_db = "timescaledb"
 timescaledb_telemetry = "off"

 [config]
-mounts = []

 [config.env]
 POSTGRES_USER = "${postgres_user}"
@@ -5,7 +5,6 @@ valkey_password = "${password:32}"
 env = [
  "VALKEY_PASSWORD=${valkey_password}"
 ]
-mounts = []

 [[config.mounts]]
 filePath = "valkey.conf"
@@ -8,8 +8,8 @@
      "name": "dokploy-templates-build-scripts",
      "version": "1.0.0",
      "dependencies": {
-        "toml": "^3.0.0",
-        "yaml": "2.7.1"
+        "toml": "4.2.0",
+        "yaml": "2.8.3"
      },
      "devDependencies": {
        "@types/node": "^20.0.0",
@@ -553,10 +553,13 @@
      }
    },
    "node_modules/toml": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/toml/-/toml-3.0.0.tgz",
-      "integrity": "sha512-y/mWCZinnvxjTKYhJ+pYxwD0mRLVvOtdS2Awbgxln6iEnt4rk0yBxeSBHkGJcPucRiG0e55mwWp+g/05rsrd6w==",
-      "license": "MIT"
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/toml/-/toml-4.2.0.tgz",
+      "integrity": "sha512-TvAJjbHZlYmI323+srtqHQFyJsoWy6mI09ppkuj9+iRsqsVKG9fvTcOP7FHF2UCb0QSYtjEavffrKzdd0XgClg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
    },
    "node_modules/tsx": {
      "version": "4.21.0",
@@ -600,15 +603,18 @@
      "license": "MIT"
    },
    "node_modules/yaml": {
-      "version": "2.7.1",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.7.1.tgz",
-      "integrity": "sha512-10ULxpnOCQXxJvBgxsn9ptjq6uviG/htZKk9veJGhlqn3w/DxQ631zFF+nlQXLwmImeS5amR2dl2U8sg6U9jsQ==",
+      "version": "2.8.3",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
+      "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
      "license": "ISC",
      "bin": {
        "yaml": "bin.mjs"
      },
      "engines": {
-        "node": ">= 14"
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
      }
    }
  }
@@ -9,8 +9,8 @@
    "process-meta": "node process-meta.js"
  },
  "dependencies": {
-    "toml": "^3.0.0",
-    "yaml": "2.7.1"
+    "toml": "4.2.0",
+    "yaml": "2.8.3"
  },
  "devDependencies": {
    "@types/node": "^20.0.0",
@@ -9,11 +9,11 @@ importers:
  .:
    dependencies:
      toml:
-        specifier: ^3.0.0
-        version: 3.0.0
+        specifier: 4.2.0
+        version: 4.2.0
      yaml:
-        specifier: 2.7.1
-        version: 2.7.1
+        specifier: 2.8.3
+        version: 2.8.3
    devDependencies:
      '@types/node':
        specifier: ^20.0.0
@@ -202,8 +202,9 @@ packages:
  resolve-pkg-maps@1.0.0:
    resolution: {integrity: sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==}

-  toml@3.0.0:
-    resolution: {integrity: sha512-y/mWCZinnvxjTKYhJ+pYxwD0mRLVvOtdS2Awbgxln6iEnt4rk0yBxeSBHkGJcPucRiG0e55mwWp+g/05rsrd6w==}
+  toml@4.2.0:
+    resolution: {integrity: sha512-TvAJjbHZlYmI323+srtqHQFyJsoWy6mI09ppkuj9+iRsqsVKG9fvTcOP7FHF2UCb0QSYtjEavffrKzdd0XgClg==}
+    engines: {node: '>=20'}

  tsx@4.21.0:
    resolution: {integrity: sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw==}
@@ -218,9 +219,9 @@ packages:
  undici-types@6.21.0:
    resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}

-  yaml@2.7.1:
-    resolution: {integrity: sha512-10ULxpnOCQXxJvBgxsn9ptjq6uviG/htZKk9veJGhlqn3w/DxQ631zFF+nlQXLwmImeS5amR2dl2U8sg6U9jsQ==}
-    engines: {node: '>= 14'}
+  yaml@2.8.3:
+    resolution: {integrity: sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==}
+    engines: {node: '>= 14.6'}
    hasBin: true

 snapshots:
@@ -345,7 +346,7 @@ snapshots:

  resolve-pkg-maps@1.0.0: {}

-  toml@3.0.0: {}
+  toml@4.2.0: {}

  tsx@4.21.0:
    dependencies:
@@ -358,4 +359,4 @@ snapshots:

  undici-types@6.21.0: {}

-  yaml@2.7.1: {}
+  yaml@2.8.3: {}