#71 · pantry-pm/pantry

This issue lists Buddy Bot updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

[!CAUTION] 96 known vulnerabilities affect 12 dependencies in this repository.

Severity	Package	Current	Advisory	Fixed in
🔴 Critical	`vitest`	`^3.0.5`	GHSA-5xrq-8626-4rwp	`4.1.0`
🔴 Critical	`lodash`	`^4.17.0`	GHSA-jf85-cpcp-j695	`4.17.12`
🟠 High	`lodash`	`^4.17.0`	GHSA-35jh-r3h4-6jhm	`4.17.21`
🟠 High	`lodash`	`^4.17.0`	GHSA-4xc9-xhrj-v574	`4.17.11`
🟠 High	`lodash`	`^4.17.0`	GHSA-p6mc-m468-83gw	`4.17.19`
🟠 High	`lodash`	`^4.17.0`	GHSA-r5fr-rjxr-66jc	`4.18.0`
🟡 Moderate	`lodash`	`^4.17.0`	GHSA-29mw-wpgm-hmr9	`4.17.21`
🟡 Moderate	`lodash`	`^4.17.0`	GHSA-f23m-r3pf-42rh	`4.18.0`
🟡 Moderate	`lodash`	`^4.17.0`	GHSA-fvqr-27wr-82fm	`4.17.5`
🟡 Moderate	`lodash`	`^4.17.0`	GHSA-x5rq-j2xg-h7qm	`4.17.11`
🟡 Moderate	`lodash`	`^4.17.0`	GHSA-xxjr-mmjv-4gpg	`4.17.23`
🟠 High	`lodash`	`^4.17.21`	GHSA-r5fr-rjxr-66jc	`4.18.0`
🟡 Moderate	`lodash`	`^4.17.21`	GHSA-f23m-r3pf-42rh	`4.18.0`
🟡 Moderate	`lodash`	`^4.17.21`	GHSA-xxjr-mmjv-4gpg	`4.17.23`
🟠 High	`vite`	`^6.1.0`	GHSA-fx2h-pf6j-xcff	`8.0.16`
🟠 High	`vite`	`^6.1.0`	GHSA-p9ff-h696-f583	`8.0.5`
🟡 Moderate	`vite`	`^6.1.0`	GHSA-356w-63v5-8wf4	`6.2.6`
🟡 Moderate	`vite`	`^6.1.0`	GHSA-4r4m-qw57-chr8	`6.2.4`
🟡 Moderate	`vite`	`^6.1.0`	GHSA-4w7w-66w2-5vf9	`8.0.5`
🟡 Moderate	`vite`	`^6.1.0`	GHSA-859w-5945-r5v3	`6.3.4`
🟡 Moderate	`vite`	`^6.1.0`	GHSA-93m4-6634-74q7	`7.1.11`
🟡 Moderate	`vite`	`^6.1.0`	GHSA-v6wh-96g9-6wx3	`8.0.16`
🟡 Moderate	`vite`	`^6.1.0`	GHSA-x574-m823-4x7w	`6.2.3`
🟡 Moderate	`vite`	`^6.1.0`	GHSA-xcj6-pq6g-qj4x	`6.2.5`
⚪ Low	`vite`	`^6.1.0`	GHSA-g4jq-h2w9-997c	`7.1.5`
⚪ Low	`vite`	`^6.1.0`	GHSA-jqfw-vq24-v9c3	`7.1.5`
🟠 High	`axios`	`^1.7.9`	GHSA-35jp-ww65-95wh	`1.16.0`
🟠 High	`axios`	`^1.7.9`	GHSA-3g43-6gmg-66jw	`1.15.2`
🟠 High	`axios`	`^1.7.9`	GHSA-43fc-jf86-j433	`1.13.5`
🟠 High	`axios`	`^1.7.9`	GHSA-4hjh-wcwx-xvwj	`1.12.0`
🟠 High	`axios`	`^1.7.9`	GHSA-6chq-wfr3-2hj9	`1.15.1`
🟠 High	`axios`	`^1.7.9`	GHSA-777c-7fjr-54vf	`1.16.0`
🟠 High	`axios`	`^1.7.9`	GHSA-hfxv-24rg-xrqf	`1.16.0`
🟠 High	`axios`	`^1.7.9`	GHSA-j5f8-grm9-p9fc	`1.16.0`
🟠 High	`axios`	`^1.7.9`	GHSA-jr5f-v2jv-69x6	`1.8.2`
🟠 High	`axios`	`^1.7.9`	GHSA-p92q-9vqr-4j8v	`1.16.0`
🟠 High	`axios`	`^1.7.9`	GHSA-pf86-5x62-jrwf	`1.15.1`
🟠 High	`axios`	`^1.7.9`	GHSA-pmwg-cvhr-8vh7	`1.15.1`
🟠 High	`axios`	`^1.7.9`	GHSA-q8qp-cvcw-x6jj	`1.15.2`
🟡 Moderate	`axios`	`^1.7.9`	GHSA-3p68-rc4w-qgx5	`1.15.0`
🟡 Moderate	`axios`	`^1.7.9`	GHSA-3w6x-2g7m-8v23	`1.15.2`
🟡 Moderate	`axios`	`^1.7.9`	GHSA-42h9-826w-cgv3	`0.33.0`
🟡 Moderate	`axios`	`^1.7.9`	GHSA-445q-vr5w-6q77	`1.15.1`
🟡 Moderate	`axios`	`^1.7.9`	GHSA-5c9x-8gcm-mpgx	`1.15.1`
🟡 Moderate	`axios`	`^1.7.9`	GHSA-62hf-57xw-28j9	`1.15.1`
🟡 Moderate	`axios`	`^1.7.9`	GHSA-7q8q-rj6j-mhjq	`0.33.0`
🟡 Moderate	`axios`	`^1.7.9`	GHSA-898c-q2cr-xwhg	`1.16.0`
🟡 Moderate	`axios`	`^1.7.9`	GHSA-fvcv-3m26-pcqx	`1.15.0`
🟡 Moderate	`axios`	`^1.7.9`	GHSA-jqh4-m9w3-8hp9	`1.18.0`
🟡 Moderate	`axios`	`^1.7.9`	GHSA-m7pr-hjqh-92cm	`1.15.1`
🟡 Moderate	`axios`	`^1.7.9`	GHSA-mmx7-hfxf-jppx	`1.18.0`
🟡 Moderate	`axios`	`^1.7.9`	GHSA-pmv8-rq9r-6j72	`0.33.0`
🟡 Moderate	`axios`	`^1.7.9`	GHSA-vf2m-468p-8v99	`1.15.1`
🟡 Moderate	`axios`	`^1.7.9`	GHSA-w9j2-pvgh-6h63	`1.15.1`
🟡 Moderate	`axios`	`^1.7.9`	GHSA-xx6v-rp6x-q39c	`1.15.1`
⚪ Low	`axios`	`^1.7.9`	GHSA-xhjh-pmcv-23jw	`1.15.1`
🟠 High	`postcss`	`^8.5.1`	GHSA-6g55-p6wh-862q	`8.5.12`
🟠 High	`postcss`	`^8.5.1`	GHSA-r28c-9q8g-f849	`8.5.18`
🟡 Moderate	`postcss`	`^8.5.1`	GHSA-fxqj-rqcc-2cmp	`8.5.23`
🟡 Moderate	`postcss`	`^8.5.1`	GHSA-qx2v-qp2m-jg93	`8.5.10`
🟠 High	`fastify`	`^5.8.3`	GHSA-247c-9743-5963	`5.8.5`
🟠 High	`next`	`^15.5.15`	GHSA-267c-6grr-h53f	`15.5.16`
🟠 High	`next`	`^15.5.15`	GHSA-26hh-7cqf-hhc6	`15.5.18`
🟠 High	`next`	`^15.5.15`	GHSA-36qx-fr4f-26g5	`15.5.16`
🟠 High	`next`	`^15.5.15`	GHSA-492v-c6pp-mqqv	`15.5.16`
🟠 High	`next`	`^15.5.15`	GHSA-89xv-2m56-2m9x	`15.5.21`
🟠 High	`next`	`^15.5.15`	GHSA-8h8q-6873-q5fj	`15.5.16`
🟠 High	`next`	`^15.5.15`	GHSA-c4j6-fc7j-m34r	`15.5.16`
🟠 High	`next`	`^15.5.15`	GHSA-m99w-x7hq-7vfj	`15.5.21`
🟠 High	`next`	`^15.5.15`	GHSA-mg66-mrh9-m8jx	`15.5.16`
🟠 High	`next`	`^15.5.15`	GHSA-p9j2-gv94-2wf4	`15.5.21`
🟡 Moderate	`next`	`^15.5.15`	GHSA-4633-3j49-mh5q	`15.5.21`
🟡 Moderate	`next`	`^15.5.15`	GHSA-4c39-4ccg-62r3	`15.5.21`
🟡 Moderate	`next`	`^15.5.15`	GHSA-68g3-v927-f742	`15.5.21`
🟡 Moderate	`next`	`^15.5.15`	GHSA-955p-x3mx-jcvp	`15.5.21`
🟡 Moderate	`next`	`^15.5.15`	GHSA-ffhc-5mcf-pf4q	`15.5.16`
🟡 Moderate	`next`	`^15.5.15`	GHSA-gx5p-jg67-6x7h	`15.5.16`
🟡 Moderate	`next`	`^15.5.15`	GHSA-h64f-5h5j-jqjh	`15.5.16`
🟡 Moderate	`next`	`^15.5.15`	GHSA-q8wf-6r8g-63ch	`15.5.21`
🟡 Moderate	`next`	`^15.5.15`	GHSA-wfc6-r584-vfw7	`15.5.16`
⚪ Low	`next`	`^15.5.15`	GHSA-3g8h-86w9-wvmq	`15.5.16`
⚪ Low	`next`	`^15.5.15`	GHSA-vfv6-92ff-j949	`15.5.16`
🟠 High	`bun`	`@1.1.0`	GHSA-4j66-8f4r-3pjx	`n/a`
🟡 Moderate	`bun`	`@1.1.0`	GHSA-v9mx-4pqq-h232	`n/a`
🟠 High	`guzzlehttp/guzzle`	`^7.0`	GHSA-v5mv-p594-2x33	`7.15.2`
🟡 Moderate	`guzzlehttp/guzzle`	`^7.0`	GHSA-94pj-82f3-465w	`7.14.2`
🟡 Moderate	`guzzlehttp/guzzle`	`^7.0`	GHSA-cwxw-98qj-8qjx	`7.12.1`
🟡 Moderate	`guzzlehttp/guzzle`	`^7.0`	GHSA-f283-ghqc-fg79	`7.15.1`
🟡 Moderate	`guzzlehttp/guzzle`	`^7.0`	GHSA-f7vp-7xgx-4w4r	`7.15.2`
🟡 Moderate	`guzzlehttp/guzzle`	`^7.0`	GHSA-g446-98w2-8p5w	`7.12.3`
🟡 Moderate	`guzzlehttp/guzzle`	`^7.0`	GHSA-h95v-h523-3mw8	`7.15.1`
🟡 Moderate	`guzzlehttp/guzzle`	`^7.0`	GHSA-wm3w-8rrp-j577	`7.15.1`
🟡 Moderate	`guzzlehttp/guzzle`	`^7.0`	GHSA-wpwq-4j6v-78m3	`7.12.1`
🟡 Moderate	`express`	`^4.18.0`	GHSA-rv95-896h-c2vc	`4.19.2`
⚪ Low	`express`	`^4.18.0`	GHSA-qw6h-vgh9-j6wx	`4.20.0`
🟡 Moderate	`nonexistent-package`	`@1.0.0`	MAL-2026-6936	`n/a`

Capped dependencies

The following packages are held below their latest version by a range declared elsewhere in the dependency tree. Updating this repository cannot move them — the constraint has to be widened where it is declared.

Package	Installed	Reachable	Latest	Capped by
`@octokit/openapi-types`	`27.0.0`	`27.0.0`	`29.0.1`	`@octokit/types` (`^27.0.0`)
`@octokit/types`	`16.0.0`	`16.0.0`	`18.0.0`	`@octokit/request-error` (`^16.0.0`), `@octokit/graphql` (`^16.0.0`), `@octokit/endpoint` (`^16.0.0`), `@octokit/core` (`^16.0.0`), `@octokit/plugin-rest-endpoint-methods` (`^16.0.0`), `@octokit/request` (`^16.0.0`), `@octokit/plugin-paginate-rest` (`^16.0.0`)
`@octokit/plugin-rest-endpoint-methods`	`17.0.0`	`17.0.0`	`18.0.0`	`@actions/github` (`^17.0.0`)
`@octokit/plugin-paginate-rest`	`14.0.0`	`14.0.0`	`15.0.0`	`@actions/github` (`^14.0.0`)
`glob`	`10.5.0`	`10.5.0`	`13.0.6`	`archiver-utils` (`^10.0.0`)
`@azure/storage-blob`	`12.33.0`	`12.33.0`	`12.34.0-beta.1`	`@actions/cache` (`^12.31.0`)
`lru-cache`	`10.4.3`	`10.4.3`	`11.5.2`	`path-scurry` (`^10.2.0`)
`wrap-ansi`	`8.1.0`	`8.1.0`	`10.0.1`	`@isaacs/cliui` (`^8.1.0`)
`https-proxy-agent`	`7.0.6`	`7.0.6`	`9.1.0`	`@typespec/ts-http-runtime` (`^7.0.0`)
`http-proxy-agent`	`7.0.2`	`7.0.2`	`9.1.0`	`@typespec/ts-http-runtime` (`^7.0.0`)
`@isaacs/cliui`	`8.0.2`	`8.0.2`	`9.0.0`	`jackspeak` (`^8.0.2`)
`agent-base`	`7.1.4`	`7.1.4`	`9.0.0`	`https-proxy-agent` (`^7.1.2`), `http-proxy-agent` (`^7.1.0`)
`undici-types`	`8.3.0`	`8.3.0`	`8.10.1`	`@types/node` (`~8.3.0`)
`@babel/runtime`	`7.29.7`	`7.29.7`	`8.0.0`	`json-schema-to-ts` (`^7.18.3`)
`archiver`	`7.0.1`	`7.0.1`	`8.0.0`	`@stacksjs/ts-craft` (`^7.0.1`)
`data-uri-to-buffer`	`6.0.2`	`6.0.2`	`8.0.0`	`ts-gif` (`^6.0.2`)
`@typescript/typescript-linux-x64`	`7.0.2`	`7.0.2`	`7.1.0-dev.20260901.1`	`typescript` (`7.0.2`)
`zip-stream`	`6.0.1`	`6.0.1`	`7.0.5`	`archiver` (`^6.0.1`)
`crc32-stream`	`6.0.0`	`6.0.0`	`7.0.1`	`compress-commons` (`^6.0.0`)
`compress-commons`	`6.0.2`	`6.0.2`	`7.0.1`	`zip-stream` (`^6.0.2`)
`which`	`2.0.2`	`2.0.2`	`7.0.0`	`cross-spawn` (`^2.0.1`)
`event-target-shim`	`5.0.1`	`5.0.1`	`6.0.2`	`abort-controller` (`^5.0.0`)
`is-fullwidth-code-point`	`3.0.0`	`3.0.0`	`5.1.0`	`string-width` (`^3.0.0`)
`jackspeak`	`3.4.3`	`3.4.3`	`4.2.3`	`glob` (`^3.1.2`)
`kleur`	`3.0.3`	`3.0.3`	`4.1.5`	`prompts` (`^3.0.3`)
`balanced-match`	`1.0.2`	`1.0.2`	`4.0.4`	`brace-expansion` (`^1.0.0`)
`foreground-child`	`3.3.1`	`3.3.1`	`4.0.3`	`glob` (`^3.1.0`)
`is-stream`	`2.0.1`	`2.0.1`	`4.0.1`	`compress-commons` (`^2.0.1`), `archiver-utils` (`^2.0.1`)
`path-key`	`3.1.1`	`3.1.1`	`4.0.0`	`cross-spawn` (`^3.1.0`)
`shebang-regex`	`3.0.0`	`3.0.0`	`4.0.0`	`shebang-command` (`^3.0.0`)
`@actions/tool-cache`	`2.0.2`	`2.0.2`	`4.0.0`	`pantry-setup` (`^2.0.1`)
`isexe`	`2.0.0`	`2.0.0`	`4.0.0`	`which` (`^2.0.0`)
`ms`	`2.1.3`	`2.1.3`	`4.0.0-nightly.202508271359`	`debug` (`^2.1.3`)
`@azure/core-lro`	`2.7.2`	`2.7.2`	`3.4.0`	`@azure/storage-blob` (`^2.2.0`)
`readdir-glob`	`1.1.3`	`1.1.3`	`3.0.0`	`archiver` (`^1.1.2`)
`@nodable/entities`	`2.2.0`	`2.2.0`	`3.0.0`	`fast-xml-parser` (`^2.2.0`)
`color-name`	`1.1.4`	`1.1.4`	`2.1.1`	`color-convert` (`~1.1.4`)
`path-scurry`	`1.11.1`	`1.11.1`	`2.0.2`	`glob` (`^1.11.1`)
`is-unsafe`	`1.0.1`	`1.0.1`	`2.0.2`	`fast-xml-parser` (`^1.0.1`)
`@stablelib/base64`	`1.0.1`	`1.0.1`	`2.0.1`	`standardwebhooks` (`^1.0.0`)
`sisteransi`	`1.0.5`	`1.0.5`	`2.0.0`	`prompts` (`^1.0.5`)
`@anthropic-ai/sdk`	`0.117.1`	`0.117.1`	`0.123.0`	`buddy-bot` (`^0.117.1`)
`@stacksjs/desktop`	`0.2.195`	`0.2.195`	`0.70.232`	`@stacksjs/stx` (`0.2.195`)
`@ts-cloud/core`	`0.9.3`	`0.9.3`	`0.12.10`	`@stacksjs/ts-cloud` (`0.9.3`)
`@ts-cloud/aws-types`	`0.9.3`	`0.9.3`	`0.12.10`	`@ts-cloud/core` (`0.9.3`), `@stacksjs/ts-cloud` (`0.9.3`)
`@stacksjs/dtsx`	`0.11.5`	`0.11.5`	`0.11.10`	`bun-plugin-dtsx` (`0.11.5`)
`@actions/glob`	`0.6.1`	`0.6.1`	`0.7.0`	`pantry-setup` (`^0.6.1`), `@actions/cache` (`^0.6.1`)
`eastasianwidth`	`0.2.0`	`0.2.0`	`0.3.0`	`string-width` (`^0.2.0`)
`xml-naming`	`0.1.0`	`0.1.0`	`0.3.0`	`fast-xml-parser` (`^0.1.0`), `fast-xml-builder` (`^0.1.0`)
`stx-router`	`0.2.195`	`0.2.195`	`0.2.263`	`@stacksjs/stx` (`0.2.195`)
`bun-plugin-stx`	`0.2.195`	`0.2.195`	`0.2.263`	`@stacksjs/stx` (`0.2.195`)
`@stacksjs/sanitizer`	`0.2.195`	`0.2.195`	`0.2.263`	`@stacksjs/stx` (`0.2.195`)
`@ts-charts/internmap`	`0.2.0`	`0.2.0`	`0.2.7`	`@ts-charts/array` (`0.2.0`)
`@ts-charts/time-format`	`0.2.0`	`0.2.0`	`0.2.7`	`@ts-charts/scale` (`0.2.0`)
`@ts-charts/color`	`0.2.0`	`0.2.0`	`0.2.7`	`@ts-charts/interpolate` (`0.2.0`)
`@ts-charts/time`	`0.2.0`	`0.2.0`	`0.2.7`	`@ts-charts/time-format` (`0.2.0`), `@ts-charts/scale` (`0.2.0`)
`@ts-charts/interpolate`	`0.2.0`	`0.2.0`	`0.2.7`	`@ts-charts/scale` (`0.2.0`)
`ts-broadcasting`	`0.0.9`	`0.0.9`	`0.0.10`	`@stacksjs/stx` (`^0.0.9`)
`concat-map`	`0.0.1`	`0.0.1`	`0.0.2`	`brace-expansion` (`0.0.1`)

Detected dependencies

npm

package.json

@cwcss/crosswind ^0.2.16
@stacksjs/stx ^0.2.192
@stacksjs/ts-cloud ^0.9.2
@stacksjs/bumpx ^0.2.16
better-dx ^0.2.23

package.json

mitata ^1.0.34

package.json

lodash ^4.17.21
chalk ^5.4.1
commander ^13.1.0

package.json

react ^19.0.0
react-dom ^19.0.0
vite ^6.1.0
typescript ^5.7.3
@vitejs/plugin-react ^4.3.4
eslint ^9.19.0
prettier ^3.4.2
vitest ^3.0.5

package.json

react ^19.0.0
react-dom ^19.0.0
react-router-dom ^7.1.3
vite ^6.1.0
@vitejs/plugin-react ^4.3.4
typescript ^5.7.3
axios ^1.7.9
zustand ^5.0.3
@tanstack/react-query ^5.66.0
tailwindcss ^4.0.6
autoprefixer ^10.4.20
postcss ^8.5.1
eslint ^9.19.0
prettier ^3.4.2
vitest ^3.0.5
@testing-library/react ^16.2.0
zod ^3.24.1
react-hook-form ^7.54.2

package.json

@stacksjs/ts-cloud ^0.7.26
bun-types latest

package.json

@stacksjs/stx ^0.2.82
@ts-charts/array ^0.2.0
@ts-charts/format ^0.2.0
@ts-charts/path ^0.2.0
@ts-charts/scale ^0.2.0
@ts-charts/shape ^0.2.0
bun-types latest
typescript ^7.0.2

package.json

bun-types latest
typescript ^7.0.2

package.json

fastify ^5.8.3
@types/node ^20.0.0
eslint ^8.0.0

package.json

lodash ^4.17.0
eslint ^8.0.0

package.json

express ^4.18.0
@types/express ^4.17.0
eslint 8

package.json

next ^15.5.15
react ^18.0.0
react-dom ^18.0.0
@types/node ^20.0.0
@types/react ^18.0.0
eslint ^8.0.0
eslint-config-next ^15.5.15
prettier ^3.0.0
typescript ^5.0.0

package.json

lodash ^4.17.0
typescript ^5.0.0

package.json

@actions/cache ^6.0.0
@actions/core ^1.11.1
@actions/exec ^1.1.1
@actions/github ^9.0.0
@actions/glob ^0.6.1
@actions/tool-cache ^2.0.1
better-dx ^0.2.6

github-actions

.github/workflows/ci-failure-issue.yml

actions/checkout v6

.github/workflows/registry-integrity.yml

actions/checkout v6

.github/workflows/ci.yml

actions/checkout v6

.github/workflows/publish-changed-packages.yml

actions/checkout v6

.github/workflows/sync-zig-dev.yml

actions/checkout v6

.github/workflows/sync-binaries.yml

actions/checkout v6
actions/cache v5

.github/workflows/update-packages.yml

actions/checkout v6
oven-sh/setup-bun v2

.github/workflows/build-versions.yml

actions/checkout v6
actions/cache v5

.github/workflows/mirror.yml

actions/checkout v6

.github/workflows/build-residual.yml

actions/checkout v6

.github/workflows/deploy-registry.yml

actions/checkout v6

.github/workflows/release.yml

actions/checkout v6

.github/workflows/backfill-malware-scans.yml

actions/checkout v6
oven-sh/setup-bun v2

.github/workflows/drain-release-queue.yml

.github/workflows/buddy-bot.yml

actions/checkout v6
oven-sh/setup-bun v2
shivammathur/setup-php v2

.github/workflows/build-orchestrator.yml

actions/checkout v6
actions/cache/restore v4
actions/cache/save v4

.github/workflows/build-zig.yml

actions/checkout v6

.github/workflows/pkgx-sync.yml

actions/checkout v6
oven-sh/setup-bun v2

.github/workflows/check-desktop-updates.yml

actions/checkout v4
oven-sh/setup-bun v2

.github/workflows/build.yml

actions/checkout v6
oven-sh/setup-bun v2
actions/cache v5

.github/workflows/build-download-recipes.yml

actions/checkout v6

.github/workflows/build-registry.yml

actions/checkout v6
oven-sh/setup-bun v2
actions/upload-artifact v4
actions/download-artifact v4

.github/workflows/health-monitor.yml

actions/checkout v6

dependency-files

deps.yaml

zig @0.17.0-dev

packages/zig/test-envs/dummy/deps.yaml

packages/zig/test-envs/laravel/deps.yaml

bun ^1.2.18
php ^8.4.0
node ^24.0.0
redis ^8.0.0
postgres ^17.0.0
composer ^2.8.10
meilisearch ^1.35.0
gnu.org/bison ^3
re2c.org ^3
apache.org/apr ^1
apache.org/apr-util ^1
bcrypt.sourceforge.net ^1
gnu.org/autoconf ^2
curl.se ^8
nghttp2.org *
gnu.org/gettext ^0
gnu.org/gmp ^6
libsodium.org <1.0.19
libzip.org ~1.9
github.com/kkos/oniguruma ^6
openssl.org ^3
pcre.org/v2 >=10.30
sqlite.org ^3
unicode.org ^73 # v25
gnu.org/libiconv ^1
kerberos.org ^1
gnome.org/libxml2 ~2.13 # 2.14 changes the API
thrysoee.dk/editline ^3
sourceware.org/libffi >=3.4.7
gnome.org/libxslt >=1.1.0<1.1.43
libpng.org ^1
google.com/webp ^1
ijg.org ^9
gnu.org/sed ^4 # phpize requires this
openldap.org ^2 # since 8.1.31, 8.2.26, 8.3.14, 8.4.0
gnu.org/gcc/libstdcxx @14
sourceware.org/bzip2 ^1
zlib.net ^1
gnu.org/m4 @1
perl.org *
curl.se/ca-certs *
tukaani.org/xz ^5 # autopoint needs this to unpack archives
facebook.com/zstd >=1.5.0
lz4.org ^1
gnu.org/readline @8
invisible-island.net/ncurses ^6
giflib.sourceforge.io ^5
libjpeg-turbo.org ^2
simplesystems.org/libtiff ^4
github.com/util-linux/util-linux *
gnu.org/binutils *
gnu.org/mpfr >=2.4.0
gnu.org/mpc >=0.8.0
darwin/x86-64 ^# since 15.1.0
php.net *

packages/zig/test-envs/rails/deps.yaml

ruby ^3.3.0
node ^24.0.0
redis ^8.0.0
postgres ^17.0.0
rubygems.org ^3.6.0 # Provides bundler, gem commands
openssl.org @1.1
pyyaml.org ^0.2
zlib.net ^1
curl.se/ca-certs *
unicode.org ^73 # v25
gnu.org/gcc/libstdcxx *
gnu.org/binutils *
gnu.org/gmp >=4.2
gnu.org/mpfr >=2.4.0
gnu.org/mpc >=0.8.0
darwin/x86-64 ^# since 15.1.0
gnu.org/readline *
lz4.org *
gnome.org/libxml2 ~2.13 # abi changed in 2.14
gnome.org/libxslt *
invisible-island.net/ncurses ^6
ruby-lang.org >=2.3

packages/zig/test-envs/test-isolation/deps.yaml

fake.com ^1.0.0
nonexistent.org ^2.0.0

packages/zig/test-envs/bun-test/deps.yaml

bun.sh @1.0.0

packages/zig/test-envs/python-focused/deps.yml

python.org ~3.12
postgresql.org ~16.1
redis.io ~7.2
zlib.net @1
sourceware.org/bzip2 @1
openssl.org ^3
sourceware.org/libffi @3
libexpat.github.io @2
bytereef.org/mpdecimal @2
tukaani.org/xz @5
sqlite.org @3
gnu.org/readline @8
invisible-island.net/ncurses @6
facebook.com/zstd >=1.5
tcl-lang.org =8.6.16 # 9.0.2 introduced a build issue on darwin
curl.se/ca-certs *
lz4.org ^1
freetype.org ^2
freedesktop.org/pkg-config ^0.29
x.org/x11 ^1
x.org/exts ^1
libpng.org @1
x.org/xcb ^1
x.org/protocol *
x.org/xau ^1
x.org/xdmcp ^1
x.org/util-macros *
gnome.org/libxml2 ~2.13 # abi changed in 2.14
gnome.org/libxslt *
unicode.org ^73

packages/zig/test-envs/mixed-global-local/dependencies.yaml

bun.sh @1.2.3
version ^3.11
node@22 @22.1.0
git@2.42 @2.42.0

packages/zig/test-envs/stacks-config/dependencies.yaml

aws/cli ^2.22.26
bun ^1.2.13
gh ^2.69.0
zip ^3.0
unzip ^6.0
sqlite3 ^3.47.2
node ^22.12.0 # only temporarily needed until bun & vue-tsc issue is resolved
sourceware.org/libffi ^3
pkgx.sh >=1
sourceware.org/bzip2 *
zlib.net @1
gnu.org/readline @8
invisible-island.net/ncurses ^6
unicode.org ^73 # v25
openssl.org @1.1
gnu.org/gcc/libstdcxx *
curl.se/ca-certs *
gnu.org/binutils *
gnu.org/gmp >=4.2
gnu.org/mpfr >=2.4.0
gnu.org/mpc >=0.8.0
darwin/x86-64 ^# since 15.1.0

packages/zig/test-envs/fullstack-mixed/dependencies.yaml

version @29.7.0
eslint@8.50 @8.50.0
prettier@3.0 @3.0.0
husky@8.0 @8.0.0

packages/zig/test-envs/individual-global-flags/dependencies.yaml

version @22.1.0
eslint@8.50 @8.50.0
jest@29.0 @29.7.0

packages/zig/test-envs/override-scenarios/dependencies.yaml

node@22 @22.1.0
python@3.12 @3.12.1
version @8.50.0
jest@29.0 @29.7.0
prettier@3.0 @3.0.0

packages/zig/test-envs/test-fail/dependencies.yaml

nonexistent-package @1.0.0

packages/zig/test-envs/team-standard/dependencies.yaml

version @29.7.0
prettier@3.0 @3.0.0
husky@8.0 @8.0.0

packages/zig/test-envs/no-global-flag/dependencies.yaml

node@22 @22.1.0
python@3.12 @3.12.1
typescript@5.0 @5.0.4

packages/zig/test-envs/dev-machine-setup/dependencies.yaml

packages/zig/test-envs/complex-deps/dependencies.yaml

nodejs.org @20.11.0
python.org @3.11.9
stedolan.github.io/jq ^1.7.0
curl.se ^8.5.0
gnu.org/wget ^1.25.0
cmake.org ^3.28.0
unicode.org ^73 # v25
openssl.org @1.1
zlib.net @1
gnu.org/gcc/libstdcxx *
curl.se/ca-certs *
gnu.org/binutils *
gnu.org/gmp >=4.2
gnu.org/mpfr >=2.4.0
gnu.org/mpc >=0.8.0
darwin/x86-64 ^# since 15.1.0
sourceware.org/bzip2 @1
sourceware.org/libffi @3
libexpat.github.io @2
bytereef.org/mpdecimal @2
tukaani.org/xz @5
sqlite.org @3
gnu.org/readline @8
invisible-island.net/ncurses @6
facebook.com/zstd >=1.5
tcl-lang.org =8.6.16 # 9.0.2 introduced a build issue on darwin
lz4.org ^1
freetype.org ^2
freedesktop.org/pkg-config ^0.29
x.org/x11 ^1
x.org/exts ^1
libpng.org @1
x.org/xcb ^1
x.org/protocol *
x.org/xau ^1
x.org/xdmcp ^1
x.org/util-macros *
github.com/kkos/oniguruma @6
nghttp2.org *

packages/zig/test-envs/test-with-deps/dependencies.yaml

bun.sh @0.5.9

packages/zig/test-envs/global-false-override/dependencies.yaml

node@22 @22.1.0
typescript@5.0 @5.0.4
version @8.50.0

packages/zig/test-envs/deeply-nested/level1/level2/level3/level4/level5/level6/level7/level8/level9/level10/final-project/dependencies.yaml

zlib.net @1.2
curl.se ^8.5.0
openssl.org ^3
curl.se/ca-certs *
nghttp2.org *

packages/zig/test-envs/global-all/dependencies.yaml

packages/zig/test-envs/simple-global-string/dependencies.yaml

packages/zig/test-envs/working-test/dependencies.yaml

python.org ~3.12
curl.se ^8.5
cmake.org ^3.28
stedolan.github.io/jq ^1.7
zlib.net @1
sourceware.org/bzip2 @1
openssl.org ^3
sourceware.org/libffi @3
libexpat.github.io @2
bytereef.org/mpdecimal @2
tukaani.org/xz @5
sqlite.org @3
gnu.org/readline @8
invisible-island.net/ncurses @6
facebook.com/zstd >=1.5
tcl-lang.org =8.6.16 # 9.0.2 introduced a build issue on darwin
curl.se/ca-certs *
lz4.org ^1
freetype.org ^2
freedesktop.org/pkg-config ^0.29
x.org/x11 ^1
x.org/exts ^1
libpng.org @1
x.org/xcb ^1
x.org/protocol *
x.org/xau ^1
x.org/xdmcp ^1
x.org/util-macros *
nghttp2.org *
github.com/kkos/oniguruma @6

packages/zig/test-envs/bun-package-manager-with-deps/dependencies.yaml

packages/zig/test-envs/test-simple/dependencies.yaml

bun @1.1.0

packages/zig/test-envs/bun-with-nodejs/dependencies.yaml

- bun.sh ^1.2.0
- nodejs.org ^20.0.0
- npmjs.com ^10.0.0
unicode.org ^73 # v25
openssl.org @1.1
zlib.net @1
gnu.org/gcc/libstdcxx *
curl.se/ca-certs *
gnu.org/binutils *
gnu.org/gmp >=4.2
gnu.org/mpfr >=2.4.0
gnu.org/mpc >=0.8.0
darwin/x86-64 ^# since 15.1.0
nodejs.org *

packages/zig/test-envs/minimal/pkgx.yaml

gnu.org/wget ^1.21
openssl.org ^1.1
curl.se/ca-certs *

packages/registry/Dockerfile

oven/bun 1
base latest
base latest
base latest

packages/zig/build.zig.zon

pantry.lock

@actions/cache 6.2.0
@actions/core 1.11.1
@actions/exec 1.1.1
@actions/github 9.1.1
@actions/glob 0.6.1
@actions/tool-cache 2.0.2
@stacksjs/bunpress 0.1.18
@stacksjs/stx 0.2.99
@stacksjs/ts-cloud 0.7.49
@ts-charts/array 0.2.3
@ts-charts/format 0.2.3
@ts-charts/path 0.2.3
@ts-charts/scale 0.2.3
@ts-charts/shape 0.2.3
@types/tar-stream 3.1.4
better-dx 0.2.19
bun-types 1.3.14-canary.20260425T142013
bun.sh 1.3.14
bunfig 0.15.15
mitata 1.0.34
tar-stream 3.2.0
ts-web-scraper 0.1.4
typescript 7.0.2
zig-bump 15ddba7d124d32dbb7884dd74ec942baced2d6bf
zig-cli 4629d10a7e8aa6de9c26996109138683235a2273
zig-config f2feb1fdc262be4b8dc14d63113024ce0ab89927
zig-test-framework c149e957e3989bdb8f9148a161f6eef4ae63d75e
ziglang.org 0.17.0-dev.1737_de207594e

packages/benchmark/fixtures/small/composer.json

monolog/monolog ^3.0
guzzlehttp/guzzle ^7.0
symfony/console ^7.0

packages/benchmark/fixtures/medium/composer.json

laravel/framework ^12.61.1
guzzlehttp/guzzle ^7.0
monolog/monolog ^3.0
symfony/console ^7.0
symfony/http-foundation ^7.0
doctrine/dbal ^4.0
phpunit/phpunit ^12.5.22
fakerphp/faker ^1.23

packages/benchmark/fixtures/large/composer.json

laravel/framework ^12.61.1
guzzlehttp/guzzle ^7.0
monolog/monolog ^3.0
symfony/console ^7.0
symfony/http-foundation ^7.0
symfony/mailer ^7.0
symfony/cache ^7.0
doctrine/dbal ^4.0
doctrine/orm ^3.0
phpunit/phpunit ^12.5.22
fakerphp/faker ^1.23
league/flysystem ^3.0
predis/predis ^2.0
ramsey/uuid ^4.7
nesbot/carbon ^3.0
spatie/laravel-permission ^6.0
livewire/livewire ^3.0
inertiajs/inertia-laravel ^1.0

Check this box to trigger a request for Buddy Bot to run again on this repository