From 7e272d18e10e10a73b554dfe8276f10fe01e3073 Mon Sep 17 00:00:00 2001
From: blam <ben@blam.sh>
Date: Thu, 15 Jun 2023 12:07:47 +0200
Subject: [PATCH 1/9] feat: replace vm2 sandbox with isolated-vm
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Fredrik Adelöw <freben@gmail.com>
Co-authored-by: Patrik Oldsberg <poldsberg@gmail.com>
Co-authored-by: Johan Haals <johan.haals@gmail.com>
Signed-off-by: blam <ben@blam.sh>
---
 plugins/scaffolder-backend/package.json       |   2 +-
 .../src/lib/templating/SecureTemplater.ts     | 126 +++++++++++-------
 yarn.lock                                     |  27 ++--
 3 files changed, 90 insertions(+), 65 deletions(-)

diff --git a/plugins/scaffolder-backend/package.json b/plugins/scaffolder-backend/package.json
index 0df6f20277..1bfbb4786c 100644
--- a/plugins/scaffolder-backend/package.json
+++ b/plugins/scaffolder-backend/package.json
@@ -78,6 +78,7 @@
     "git-url-parse": "^13.0.0",
     "globby": "^11.0.0",
     "isbinaryfile": "^5.0.0",
+    "isolated-vm": "^4.5.0",
     "isomorphic-git": "^1.23.0",
     "jsonschema": "^1.2.6",
     "knex": "^2.0.0",
@@ -93,7 +94,6 @@
     "p-queue": "^6.6.2",
     "prom-client": "^14.0.1",
     "uuid": "^8.2.0",
-    "vm2": "^3.9.18",
     "winston": "^3.2.1",
     "yaml": "^2.0.0",
     "zen-observable": "^0.10.0",
diff --git a/plugins/scaffolder-backend/src/lib/templating/SecureTemplater.ts b/plugins/scaffolder-backend/src/lib/templating/SecureTemplater.ts
index f0ccb6f192..0a553665c9 100644
--- a/plugins/scaffolder-backend/src/lib/templating/SecureTemplater.ts
+++ b/plugins/scaffolder-backend/src/lib/templating/SecureTemplater.ts
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-import { VM } from 'vm2';
+import { Isolate } from 'isolated-vm';
 import { resolvePackagePath } from '@backstage/backend-common';
 import fs from 'fs-extra';
 import { JsonValue } from '@backstage/types';
@@ -45,20 +45,14 @@ const { render, renderCompat } = (() => {
   });
   compatEnv.addFilter('jsonify', compatEnv.getFilter('dump'));
 
-  if (typeof templateFilters !== 'undefined') {
-    for (const [filterName, filterFn] of Object.entries(templateFilters)) {
-      env.addFilter(filterName, (...args) => JSON.parse(filterFn(...args)));
-    }
+  for (const name of JSON.parse(availableTemplateFilters)) {
+    env.addFilter(name, (...args) => JSON.parse(callFilter(name, args)));
   }
-
-  if (typeof templateGlobals !== 'undefined') {
-    for (const [globalName, global] of Object.entries(templateGlobals)) {
-      if (typeof global === 'function') {
-        env.addGlobal(globalName, (...args) => JSON.parse(global(...args)));
-      } else {
-        env.addGlobal(globalName, JSON.parse(global));
-      }
-    }
+  for (const [name, value] of Object.entries(JSON.parse(availableTemplateGlobals))) {
+    env.addGlobal(name, value);
+  }
+  for (const name of JSON.parse(availableTemplateCallbacks)) {
+    env.addGlobal(name, (...args) => JSON.parse(callGlobal(name, args)));
   }
 
   let uninstallCompat = undefined;
@@ -116,35 +110,14 @@ export type SecureTemplateRenderer = (
 
 export class SecureTemplater {
   static async loadRenderer(options: SecureTemplaterOptions = {}) {
-    const { cookiecutterCompat, templateFilters, templateGlobals } = options;
-    const sandbox: Record<string, any> = {};
-
-    if (templateFilters) {
-      sandbox.templateFilters = Object.fromEntries(
-        Object.entries(templateFilters)
-          .filter(([_, filterFunction]) => !!filterFunction)
-          .map(([filterName, filterFunction]) => [
-            filterName,
-            (...args: JsonValue[]) => JSON.stringify(filterFunction(...args)),
-          ]),
-      );
-    }
-    if (templateGlobals) {
-      sandbox.templateGlobals = Object.fromEntries(
-        Object.entries(templateGlobals)
-          .filter(([_, global]) => !!global)
-          .map(([globalName, global]) => {
-            if (typeof global === 'function') {
-              return [
-                globalName,
-                (...args: JsonValue[]) => JSON.stringify(global(...args)),
-              ];
-            }
-            return [globalName, JSON.stringify(global)];
-          }),
-      );
-    }
-    const vm = new VM({ sandbox });
+    const {
+      cookiecutterCompat,
+      templateFilters = {},
+      templateGlobals = {},
+    } = options;
+    const isolate = new Isolate({ memoryLimit: 128 });
+    const context = await isolate.createContext();
+    const contextGlobal = context.global;
 
     const nunjucksSource = await fs.readFile(
       resolvePackagePath(
@@ -154,20 +127,75 @@ export class SecureTemplater {
       'utf-8',
     );
 
-    vm.run(mkScript(nunjucksSource));
+    const nunjucksScript = await isolate.compileScript(
+      mkScript(nunjucksSource),
+    );
+
+    const availableFilters = Object.keys(templateFilters);
+
+    await contextGlobal.set(
+      'availableTemplateFilters',
+      JSON.stringify(availableFilters),
+    );
+
+    const globalCallbacks = [];
+    const globalValues: Record<string, unknown> = {};
+    for (const [name, value] of Object.entries(templateGlobals)) {
+      if (typeof value === 'function') {
+        globalCallbacks.push(name);
+      } else {
+        globalValues[name] = value;
+      }
+    }
+
+    await contextGlobal.set(
+      'availableTemplateGlobals',
+      JSON.stringify(globalValues),
+    );
+    await contextGlobal.set(
+      'availableTemplateCallbacks',
+      JSON.stringify(globalCallbacks),
+    );
+
+    await contextGlobal.set(
+      'callFilter',
+      (filterName: string, args: JsonValue[]) => {
+        if (!Object.hasOwn(templateFilters, filterName)) {
+          return '';
+        }
+        return JSON.stringify(templateFilters[filterName](...args));
+      },
+    );
+
+    await contextGlobal.set(
+      'callGlobal',
+      (globalName: string, args: JsonValue[]) => {
+        if (!Object.hasOwn(templateGlobals, globalName)) {
+          return '';
+        }
+        const global = templateGlobals[globalName];
+        if (typeof global !== 'function') {
+          return '';
+        }
+        return JSON.stringify(global(...args));
+      },
+    );
+
+    await nunjucksScript.run(context);
 
     const render: SecureTemplateRenderer = (template, values) => {
-      if (!vm) {
+      if (!context) {
         throw new Error('SecureTemplater has not been initialized');
       }
-      vm.setGlobal('templateStr', template);
-      vm.setGlobal('templateValues', JSON.stringify(values));
+
+      contextGlobal.setSync('templateStr', String(template));
+      contextGlobal.setSync('templateValues', JSON.stringify(values));
 
       if (cookiecutterCompat) {
-        return vm.run(`renderCompat(templateStr, templateValues)`);
+        return context.evalSync(`renderCompat(templateStr, templateValues)`);
       }
 
-      return vm.run(`render(templateStr, templateValues)`);
+      return context.evalSync(`render(templateStr, templateValues)`);
     };
     return render;
   }
diff --git a/yarn.lock b/yarn.lock
index 5e0ef2cc88..d7a0ba23e9 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -8664,6 +8664,7 @@ __metadata:
     git-url-parse: ^13.0.0
     globby: ^11.0.0
     isbinaryfile: ^5.0.0
+    isolated-vm: ^4.5.0
     isomorphic-git: ^1.23.0
     jest-when: ^3.1.0
     jsonschema: ^1.2.6
@@ -8683,7 +8684,6 @@ __metadata:
     prom-client: ^14.0.1
     supertest: ^6.1.3
     uuid: ^8.2.0
-    vm2: ^3.9.18
     wait-for-expect: ^3.0.2
     winston: ^3.2.1
     yaml: ^2.0.0
@@ -18616,7 +18616,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"acorn-walk@npm:^8.1.1, acorn-walk@npm:^8.2.0":
+"acorn-walk@npm:^8.1.1":
   version: 8.2.0
   resolution: "acorn-walk@npm:8.2.0"
   checksum: 1715e76c01dd7b2d4ca472f9c58968516a4899378a63ad5b6c2d668bba8da21a71976c14ec5f5b75f887b6317c4ae0b897ab141c831d741dc76024d8745f1ad1
@@ -18632,7 +18632,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"acorn@npm:^8.2.4, acorn@npm:^8.4.1, acorn@npm:^8.5.0, acorn@npm:^8.7.0, acorn@npm:^8.7.1, acorn@npm:^8.8.0":
+"acorn@npm:^8.2.4, acorn@npm:^8.4.1, acorn@npm:^8.5.0, acorn@npm:^8.7.1, acorn@npm:^8.8.0":
   version: 8.8.0
   resolution: "acorn@npm:8.8.0"
   bin:
@@ -28287,6 +28287,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"isolated-vm@npm:^4.5.0":
+  version: 4.5.0
+  resolution: "isolated-vm@npm:4.5.0"
+  dependencies:
+    node-gyp: latest
+  checksum: 86626a72d35ed0ee731e00ad19bc6e8a0433c4f34a5dd5b1d415d425f1f0f6b0d04c6d10e7a588025b2956d562fcf7a69e9e20f96746978d3a4e7862374a3806
+  languageName: node
+  linkType: hard
+
 "isomorphic-dompurify@npm:^0.13.0":
   version: 0.13.0
   resolution: "isomorphic-dompurify@npm:0.13.0"
@@ -40969,18 +40978,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"vm2@npm:^3.9.18":
-  version: 3.9.19
-  resolution: "vm2@npm:3.9.19"
-  dependencies:
-    acorn: ^8.7.0
-    acorn-walk: ^8.2.0
-  bin:
-    vm2: bin/vm2
-  checksum: fc6cf553134145cd7bb5246985bf242b056e3fb5ea71e2eef6710b2a5d6c6119cc6bc960435ff62480ee82efb43369be8f4db07b6690916ae7d3b2e714f395d8
-  languageName: node
-  linkType: hard
-
 "vscode-languageserver-types@npm:^3.15.1":
   version: 3.15.1
   resolution: "vscode-languageserver-types@npm:3.15.1"

From fb7375507d56faedcb7bb3665480070593c8949a Mon Sep 17 00:00:00 2001
From: blam <ben@blam.sh>
Date: Thu, 15 Jun 2023 12:07:47 +0200
Subject: [PATCH 2/9] feat: replace vm2 sandbox with isolated-vm
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Fredrik Adelöw <freben@gmail.com>
Co-authored-by: Patrik Oldsberg <poldsberg@gmail.com>
Co-authored-by: Johan Haals <johan.haals@gmail.com>
Signed-off-by: blam <ben@blam.sh>
---
 plugins/scaffolder-backend/src/lib/templating/SecureTemplater.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/plugins/scaffolder-backend/src/lib/templating/SecureTemplater.ts b/plugins/scaffolder-backend/src/lib/templating/SecureTemplater.ts
index 0a553665c9..488604e981 100644
--- a/plugins/scaffolder-backend/src/lib/templating/SecureTemplater.ts
+++ b/plugins/scaffolder-backend/src/lib/templating/SecureTemplater.ts
@@ -115,6 +115,7 @@ export class SecureTemplater {
       templateFilters = {},
       templateGlobals = {},
     } = options;
+
     const isolate = new Isolate({ memoryLimit: 128 });
     const context = await isolate.createContext();
     const contextGlobal = context.global;

From a2c70cdda202e7e06f243d415a30e1f86f4dcd59 Mon Sep 17 00:00:00 2001
From: blam <ben@blam.sh>
Date: Thu, 15 Jun 2023 15:13:15 +0200
Subject: [PATCH 3/9] chore: added changeset

Signed-off-by: blam <ben@blam.sh>
---
 .changeset/popular-donuts-shout.md | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 .changeset/popular-donuts-shout.md

diff --git a/.changeset/popular-donuts-shout.md b/.changeset/popular-donuts-shout.md
new file mode 100644
index 0000000000..ff30242452
--- /dev/null
+++ b/.changeset/popular-donuts-shout.md
@@ -0,0 +1,9 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Switch out the sandbox to `isolated-vm` in favour of `vm2`.
+
+This is a native dependency, which means that it will need to be compiled with the same version of node on the same OS. This could cause some issues when running in Docker for instance, as you will need to make sure that the dependency is installed and compiled inside the docker container that it will run on.
+
+This could mean adding in some dependencies to the container like `build-essential` to make sure that this compiles correctly.

From 88463cd52e5046922e15ca5920ce0466d8ebc160 Mon Sep 17 00:00:00 2001
From: blam <ben@blam.sh>
Date: Thu, 15 Jun 2023 15:32:09 +0200
Subject: [PATCH 4/9] chore: remove node-gyp cache

Signed-off-by: blam <ben@blam.sh>
---
 .github/workflows/verify_e2e-windows.yml | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/verify_e2e-windows.yml b/.github/workflows/verify_e2e-windows.yml
index a454c57c4e..82b599ccec 100644
--- a/.github/workflows/verify_e2e-windows.yml
+++ b/.github/workflows/verify_e2e-windows.yml
@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: windows-2019
+    runs-on: windows-2022
 
     strategy:
       matrix:
@@ -48,10 +48,24 @@ jobs:
         uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
+
+      - name: setup python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+
       - name: Add msbuild to PATH
         uses: microsoft/setup-msbuild@v1.3.1
+
+      - name: Patch node-gyp to support Visual Studio 2022
+        shell: powershell
+        run: |
+          npm install --global node-gyp@latest
+          npm prefix -g | % {npm config set node_gyp "$_\node_modules\node-gyp\bin\node-gyp.js"}
+
       - name: setup chrome
         uses: browser-actions/setup-chrome@latest
+
       - name: yarn install
         run: yarn install --immutable
 

From e9855cd4ed829fc5eed4dc8b207506a635ecc374 Mon Sep 17 00:00:00 2001
From: Ben Lambert <blam@spotify.com>
Date: Thu, 15 Jun 2023 18:06:00 +0200
Subject: [PATCH 5/9] Update .changeset/popular-donuts-shout.md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Fredrik Adelöw <freben@gmail.com>
Signed-off-by: Ben Lambert <ben@blam.sh>
Signed-off-by: blam <ben@blam.sh>
---
 .changeset/popular-donuts-shout.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.changeset/popular-donuts-shout.md b/.changeset/popular-donuts-shout.md
index ff30242452..6c40f4d643 100644
--- a/.changeset/popular-donuts-shout.md
+++ b/.changeset/popular-donuts-shout.md
@@ -2,7 +2,7 @@
 '@backstage/plugin-scaffolder-backend': patch
 ---
 
-Switch out the sandbox to `isolated-vm` in favour of `vm2`.
+Switch out the sandbox, from `vm2` to `isolated-vm`.
 
 This is a native dependency, which means that it will need to be compiled with the same version of node on the same OS. This could cause some issues when running in Docker for instance, as you will need to make sure that the dependency is installed and compiled inside the docker container that it will run on.
 

From 225f469e5d5404cea1696f8538690bc7219cdd96 Mon Sep 17 00:00:00 2001
From: blam <ben@blam.sh>
Date: Thu, 15 Jun 2023 18:17:10 +0200
Subject: [PATCH 6/9] changeset: update the text and point to install
 requirements

Signed-off-by: blam <ben@blam.sh>
---
 .changeset/popular-donuts-shout.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.changeset/popular-donuts-shout.md b/.changeset/popular-donuts-shout.md
index 6c40f4d643..8c2f596dd4 100644
--- a/.changeset/popular-donuts-shout.md
+++ b/.changeset/popular-donuts-shout.md
@@ -7,3 +7,5 @@ Switch out the sandbox, from `vm2` to `isolated-vm`.
 This is a native dependency, which means that it will need to be compiled with the same version of node on the same OS. This could cause some issues when running in Docker for instance, as you will need to make sure that the dependency is installed and compiled inside the docker container that it will run on.
 
 This could mean adding in some dependencies to the container like `build-essential` to make sure that this compiles correctly.
+
+If you're having issues installing this dependency, there's some [install instructions](https://github.com/laverdet/isolated-vm#requirements) over on `isolated-vm`'s repo.

From d90ca192402abdcf913095d3d6e97c3a8eaa7fac Mon Sep 17 00:00:00 2001
From: blam <ben@blam.sh>
Date: Fri, 16 Jun 2023 13:56:04 +0200
Subject: [PATCH 7/9] chore: try some tips from the gyp repo

Signed-off-by: blam <ben@blam.sh>
---
 .github/workflows/verify_e2e-windows.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/verify_e2e-windows.yml b/.github/workflows/verify_e2e-windows.yml
index 82b599ccec..5df1c1dbaf 100644
--- a/.github/workflows/verify_e2e-windows.yml
+++ b/.github/workflows/verify_e2e-windows.yml
@@ -57,7 +57,12 @@ jobs:
       - name: Add msbuild to PATH
         uses: microsoft/setup-msbuild@v1.3.1
 
-      - name: Patch node-gyp to support Visual Studio 2022
+      - name: Setup gyp env
+        run: |
+          echo 'GYP_MSVS_VERSION=2022' >> $Env:GITHUB_ENV
+          echo 'GYP_MSVS_OVERRIDE_PATH=C:\\Dummy' >> $Env:GITHUB_ENV
+
+      - name: Install latest gyp and set node-gyp path
         shell: powershell
         run: |
           npm install --global node-gyp@latest

From 93dcbfb02f59875a6eafa9afbd1cf6630850464e Mon Sep 17 00:00:00 2001
From: blam <ben@blam.sh>
Date: Fri, 16 Jun 2023 14:19:03 +0200
Subject: [PATCH 8/9] chore: try something else

Signed-off-by: blam <ben@blam.sh>
---
 .github/workflows/verify_e2e-windows.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/verify_e2e-windows.yml b/.github/workflows/verify_e2e-windows.yml
index 5df1c1dbaf..3d392d2d62 100644
--- a/.github/workflows/verify_e2e-windows.yml
+++ b/.github/workflows/verify_e2e-windows.yml
@@ -65,7 +65,8 @@ jobs:
       - name: Install latest gyp and set node-gyp path
         shell: powershell
         run: |
-          npm install --global node-gyp@latest
+          npm prefix -g | % {npm config set npm_config_devdir "c:\temp\.gyp2"}
+          npm install --global node-gyp@9.2.0
           npm prefix -g | % {npm config set node_gyp "$_\node_modules\node-gyp\bin\node-gyp.js"}
 
       - name: setup chrome

From 85a7a3225d464cb5b66a47b84ca2824e85b47f3b Mon Sep 17 00:00:00 2001
From: blam <ben@blam.sh>
Date: Fri, 16 Jun 2023 14:35:32 +0200
Subject: [PATCH 9/9] chore: bump node-gyp

Signed-off-by: blam <ben@blam.sh>
---
 .github/workflows/verify_e2e-windows.yml |   3 +-
 package.json                             |   2 +-
 yarn.lock                                | 322 ++++++++++++++++++-----
 3 files changed, 260 insertions(+), 67 deletions(-)

diff --git a/.github/workflows/verify_e2e-windows.yml b/.github/workflows/verify_e2e-windows.yml
index 3d392d2d62..5a2f0a5fc1 100644
--- a/.github/workflows/verify_e2e-windows.yml
+++ b/.github/workflows/verify_e2e-windows.yml
@@ -65,8 +65,7 @@ jobs:
       - name: Install latest gyp and set node-gyp path
         shell: powershell
         run: |
-          npm prefix -g | % {npm config set npm_config_devdir "c:\temp\.gyp2"}
-          npm install --global node-gyp@9.2.0
+          npm prefix -g | % {npm config set dev_dir "c:\temp\.gyp2"}
           npm prefix -g | % {npm config set node_gyp "$_\node_modules\node-gyp\bin\node-gyp.js"}
 
       - name: setup chrome
diff --git a/package.json b/package.json
index d91d642b80..12d6fa9b12 100644
--- a/package.json
+++ b/package.json
@@ -76,7 +76,7 @@
     "husky": "^8.0.0",
     "lint-staged": "^13.0.0",
     "minimist": "^1.2.5",
-    "node-gyp": "^9.1.0",
+    "node-gyp": "^9.4.0",
     "prettier": "^2.2.1",
     "semver": "^7.3.2",
     "shx": "^0.3.2",
diff --git a/yarn.lock b/yarn.lock
index d7a0ba23e9..15eea1a789 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -12320,6 +12320,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@isaacs/cliui@npm:^8.0.2":
+  version: 8.0.2
+  resolution: "@isaacs/cliui@npm:8.0.2"
+  dependencies:
+    string-width: ^5.1.2
+    string-width-cjs: "npm:string-width@^4.2.0"
+    strip-ansi: ^7.0.1
+    strip-ansi-cjs: "npm:strip-ansi@^6.0.1"
+    wrap-ansi: ^8.1.0
+    wrap-ansi-cjs: "npm:wrap-ansi@^7.0.0"
+  checksum: 4a473b9b32a7d4d3cfb7a614226e555091ff0c5a29a1734c28c72a182c2f6699b26fc6b5c2131dfd841e86b185aea714c72201d7c98c2fba5f17709333a67aeb
+  languageName: node
+  linkType: hard
+
 "@isaacs/string-locale-compare@npm:^1.1.0":
   version: 1.1.0
   resolution: "@isaacs/string-locale-compare@npm:1.1.0"
@@ -13630,6 +13644,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@npmcli/fs@npm:^3.1.0":
+  version: 3.1.0
+  resolution: "@npmcli/fs@npm:3.1.0"
+  dependencies:
+    semver: ^7.3.5
+  checksum: a50a6818de5fc557d0b0e6f50ec780a7a02ab8ad07e5ac8b16bf519e0ad60a144ac64f97d05c443c3367235d337182e1d012bbac0eb8dbae8dc7b40b193efd0e
+  languageName: node
+  linkType: hard
+
 "@npmcli/git@npm:^2.1.0":
   version: 2.1.0
   resolution: "@npmcli/git@npm:2.1.0"
@@ -14367,6 +14390,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@pkgjs/parseargs@npm:^0.11.0":
+  version: 0.11.0
+  resolution: "@pkgjs/parseargs@npm:0.11.0"
+  checksum: 6ad6a00fc4f2f2cfc6bff76fb1d88b8ee20bc0601e18ebb01b6d4be583733a860239a521a7fbca73b612e66705078809483549d2b18f370eb346c5155c8e4a0f
+  languageName: node
+  linkType: hard
+
 "@pmmmwh/react-refresh-webpack-plugin@npm:^0.5.7":
   version: 0.5.10
   resolution: "@pmmmwh/react-refresh-webpack-plugin@npm:0.5.10"
@@ -18873,10 +18903,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ansi-styles@npm:^6.0.0":
-  version: 6.1.0
-  resolution: "ansi-styles@npm:6.1.0"
-  checksum: 7a7f8528c07a9d20c3a92bccd2b6bc3bb4d26e5cb775c02826921477377bd495d615d61f710d56216344b6238d1d11ef2b0348e146c5b128715578bfb3217229
+"ansi-styles@npm:^6.0.0, ansi-styles@npm:^6.1.0":
+  version: 6.2.1
+  resolution: "ansi-styles@npm:6.2.1"
+  checksum: ef940f2f0ced1a6347398da88a91da7930c33ecac3c77b72c5905f8b8fe402c52e6fde304ff5347f616e27a742da3f1dc76de98f6866c69251ad0b07a66776d9
   languageName: node
   linkType: hard
 
@@ -20290,6 +20320,26 @@ __metadata:
   languageName: node
   linkType: hard
 
+"cacache@npm:^17.0.0":
+  version: 17.1.3
+  resolution: "cacache@npm:17.1.3"
+  dependencies:
+    "@npmcli/fs": ^3.1.0
+    fs-minipass: ^3.0.0
+    glob: ^10.2.2
+    lru-cache: ^7.7.1
+    minipass: ^5.0.0
+    minipass-collect: ^1.0.2
+    minipass-flush: ^1.0.5
+    minipass-pipeline: ^1.2.4
+    p-map: ^4.0.0
+    ssri: ^10.0.0
+    tar: ^6.1.11
+    unique-filename: ^3.0.0
+  checksum: 385756781e1e21af089160d89d7462b7ed9883c978e848c7075b90b73cb823680e66092d61513050164588387d2ca87dd6d910e28d64bc13a9ac82cd8580c796
+  languageName: node
+  linkType: hard
+
 "cacheable-lookup@npm:^5.0.3":
   version: 5.0.3
   resolution: "cacheable-lookup@npm:5.0.3"
@@ -24861,6 +24911,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"exponential-backoff@npm:^3.1.1":
+  version: 3.1.1
+  resolution: "exponential-backoff@npm:3.1.1"
+  checksum: 3d21519a4f8207c99f7457287291316306255a328770d320b401114ec8481986e4e467e854cb9914dd965e0a1ca810a23ccb559c642c88f4c7f55c55778a9b48
+  languageName: node
+  linkType: hard
+
 "express-prom-bundle@npm:^6.3.6":
   version: 6.6.0
   resolution: "express-prom-bundle@npm:6.6.0"
@@ -25517,6 +25574,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"foreground-child@npm:^3.1.0":
+  version: 3.1.1
+  resolution: "foreground-child@npm:3.1.1"
+  dependencies:
+    cross-spawn: ^7.0.0
+    signal-exit: ^4.0.1
+  checksum: 139d270bc82dc9e6f8bc045fe2aae4001dc2472157044fdfad376d0a3457f77857fa883c1c8b21b491c6caade9a926a4bed3d3d2e8d3c9202b151a4cbbd0bcd5
+  languageName: node
+  linkType: hard
+
 "forever-agent@npm:~0.6.1":
   version: 0.6.1
   resolution: "forever-agent@npm:0.6.1"
@@ -25770,6 +25837,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"fs-minipass@npm:^3.0.0":
+  version: 3.0.2
+  resolution: "fs-minipass@npm:3.0.2"
+  dependencies:
+    minipass: ^5.0.0
+  checksum: e9cc0e1f2d01c6f6f62f567aee59530aba65c6c7b2ae88c5027bc34c711ebcfcfaefd0caf254afa6adfe7d1fba16bc2537508a6235196bac7276747d078aef0a
+  languageName: node
+  linkType: hard
+
 "fs-monkey@npm:1.0.3":
   version: 1.0.3
   resolution: "fs-monkey@npm:1.0.3"
@@ -26125,6 +26201,21 @@ __metadata:
   languageName: node
   linkType: hard
 
+"glob@npm:^10.2.2":
+  version: 10.2.7
+  resolution: "glob@npm:10.2.7"
+  dependencies:
+    foreground-child: ^3.1.0
+    jackspeak: ^2.0.3
+    minimatch: ^9.0.1
+    minipass: ^5.0.0 || ^6.0.2
+    path-scurry: ^1.7.0
+  bin:
+    glob: dist/cjs/src/bin.js
+  checksum: 555205a74607d6f8d9874ba888924b305b5ea1abfaa2e9ccb11ac713d040aac7edbf7d8702a2f4a1cd81b2d7666412170ce7ef061d33cddde189dae8c1a1a054
+  languageName: node
+  linkType: hard
+
 "glob@npm:^7.0.0, glob@npm:^7.1.1, glob@npm:^7.1.3, glob@npm:^7.1.4, glob@npm:^7.1.6, glob@npm:^7.1.7, glob@npm:^7.2.0":
   version: 7.2.3
   resolution: "glob@npm:7.2.3"
@@ -26968,7 +27059,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"http-cache-semantics@npm:^4.0.0, http-cache-semantics@npm:^4.1.0":
+"http-cache-semantics@npm:^4.0.0, http-cache-semantics@npm:^4.1.0, http-cache-semantics@npm:^4.1.1":
   version: 4.1.1
   resolution: "http-cache-semantics@npm:4.1.1"
   checksum: 83ac0bc60b17a3a36f9953e7be55e5c8f41acc61b22583060e8dedc9dd5e3607c823a88d0926f9150e571f90946835c7fe150732801010845c72cd8bbff1a236
@@ -28439,6 +28530,19 @@ __metadata:
   languageName: node
   linkType: hard
 
+"jackspeak@npm:^2.0.3":
+  version: 2.2.1
+  resolution: "jackspeak@npm:2.2.1"
+  dependencies:
+    "@isaacs/cliui": ^8.0.2
+    "@pkgjs/parseargs": ^0.11.0
+  dependenciesMeta:
+    "@pkgjs/parseargs":
+      optional: true
+  checksum: e29291c0d0f280a063fa18fbd1e891ab8c2d7519fd34052c0ebde38538a15c603140d60c2c7f432375ff7ee4c5f1c10daa8b2ae19a97c3d4affe308c8360c1df
+  languageName: node
+  linkType: hard
+
 "jake@npm:^10.8.5":
   version: 10.8.5
   resolution: "jake@npm:10.8.5"
@@ -30782,10 +30886,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lru-cache@npm:^9.0.0":
-  version: 9.1.1
-  resolution: "lru-cache@npm:9.1.1"
-  checksum: 4d703bb9b66216bbee55ead82a9682820a2b6acbdfca491b235390b1ef1056000a032d56dfb373fdf9ad4492f1fa9d04cc9a05a77f25bd7ce6901d21ad9b68b7
+"lru-cache@npm:^9.0.0, lru-cache@npm:^9.1.1":
+  version: 9.1.2
+  resolution: "lru-cache@npm:9.1.2"
+  checksum: d3415634be3908909081fc4c56371a8d562d9081eba70543d86871b978702fffd0e9e362b83921b27a29ae2b37b90f55675aad770a54ac83bb3e4de5049d4b15
   languageName: node
   linkType: hard
 
@@ -30872,7 +30976,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"make-fetch-happen@npm:^10.0.1, make-fetch-happen@npm:^10.0.3":
+"make-fetch-happen@npm:^10.0.1":
   version: 10.2.1
   resolution: "make-fetch-happen@npm:10.2.1"
   dependencies:
@@ -30896,6 +31000,29 @@ __metadata:
   languageName: node
   linkType: hard
 
+"make-fetch-happen@npm:^11.0.3":
+  version: 11.1.1
+  resolution: "make-fetch-happen@npm:11.1.1"
+  dependencies:
+    agentkeepalive: ^4.2.1
+    cacache: ^17.0.0
+    http-cache-semantics: ^4.1.1
+    http-proxy-agent: ^5.0.0
+    https-proxy-agent: ^5.0.0
+    is-lambda: ^1.0.1
+    lru-cache: ^7.7.1
+    minipass: ^5.0.0
+    minipass-fetch: ^3.0.0
+    minipass-flush: ^1.0.5
+    minipass-pipeline: ^1.2.4
+    negotiator: ^0.6.3
+    promise-retry: ^2.0.1
+    socks-proxy-agent: ^7.0.0
+    ssri: ^10.0.0
+  checksum: 7268bf274a0f6dcf0343829489a4506603ff34bd0649c12058753900b0eb29191dce5dba12680719a5d0a983d3e57810f594a12f3c18494e93a1fbc6348a4540
+  languageName: node
+  linkType: hard
+
 "make-fetch-happen@npm:^9.1.0":
   version: 9.1.0
   resolution: "make-fetch-happen@npm:9.1.0"
@@ -31870,6 +31997,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"minimatch@npm:^9.0.1":
+  version: 9.0.1
+  resolution: "minimatch@npm:9.0.1"
+  dependencies:
+    brace-expansion: ^2.0.1
+  checksum: 97f5f5284bb57dc65b9415dec7f17a0f6531a33572193991c60ff18450dcfad5c2dad24ffeaf60b5261dccd63aae58cc3306e2209d57e7f88c51295a532d8ec3
+  languageName: node
+  linkType: hard
+
 "minimist-options@npm:^4.0.2":
   version: 4.1.0
   resolution: "minimist-options@npm:4.1.0"
@@ -31936,6 +32072,21 @@ __metadata:
   languageName: node
   linkType: hard
 
+"minipass-fetch@npm:^3.0.0":
+  version: 3.0.3
+  resolution: "minipass-fetch@npm:3.0.3"
+  dependencies:
+    encoding: ^0.1.13
+    minipass: ^5.0.0
+    minipass-sized: ^1.0.3
+    minizlib: ^2.1.2
+  dependenciesMeta:
+    encoding:
+      optional: true
+  checksum: af5ab2552a16fcf505d35fd7ffb84b57f4a0eeb269e6e1d9a2a75824dda48b36e527083250b7cca4a4def21d9544e2ade441e4730e233c0bc2133f6abda31e18
+  languageName: node
+  linkType: hard
+
 "minipass-flush@npm:^1.0.5":
   version: 1.0.5
   resolution: "minipass-flush@npm:1.0.5"
@@ -31998,6 +32149,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"minipass@npm:^5.0.0 || ^6.0.2":
+  version: 6.0.2
+  resolution: "minipass@npm:6.0.2"
+  checksum: d140b91f4ab2e5ce5a9b6c468c0e82223504acc89114c1a120d4495188b81fedf8cade72a9f4793642b4e66672f990f1e0d902dd858485216a07cd3c8a62fac9
+  languageName: node
+  linkType: hard
+
 "minizlib@npm:^2.0.0, minizlib@npm:^2.1.1, minizlib@npm:^2.1.2":
   version: 2.1.2
   resolution: "minizlib@npm:2.1.2"
@@ -32507,14 +32665,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"node-gyp@npm:^9.1.0":
-  version: 9.3.1
-  resolution: "node-gyp@npm:9.3.1"
+"node-gyp@npm:^9.4.0, node-gyp@npm:latest":
+  version: 9.4.0
+  resolution: "node-gyp@npm:9.4.0"
   dependencies:
     env-paths: ^2.2.0
+    exponential-backoff: ^3.1.1
     glob: ^7.1.4
     graceful-fs: ^4.2.6
-    make-fetch-happen: ^10.0.3
+    make-fetch-happen: ^11.0.3
     nopt: ^6.0.0
     npmlog: ^6.0.0
     rimraf: ^3.0.2
@@ -32523,27 +32682,7 @@ __metadata:
     which: ^2.0.2
   bin:
     node-gyp: bin/node-gyp.js
-  checksum: b860e9976fa645ca0789c69e25387401b4396b93c8375489b5151a6c55cf2640a3b6183c212b38625ef7c508994930b72198338e3d09b9d7ade5acc4aaf51ea7
-  languageName: node
-  linkType: hard
-
-"node-gyp@npm:latest":
-  version: 9.1.0
-  resolution: "node-gyp@npm:9.1.0"
-  dependencies:
-    env-paths: ^2.2.0
-    glob: ^7.1.4
-    graceful-fs: ^4.2.6
-    make-fetch-happen: ^10.0.3
-    nopt: ^5.0.0
-    npmlog: ^6.0.0
-    rimraf: ^3.0.2
-    semver: ^7.3.5
-    tar: ^6.1.2
-    which: ^2.0.2
-  bin:
-    node-gyp: bin/node-gyp.js
-  checksum: 1437fa4a879b5b9010604128e8da8609b57c66034262087539ee04a8b764b8436af2be01bab66f8fc729a3adba2dcc21b10a32b9f552696c3fa8cd657d134fc4
+  checksum: 78b404e2e0639d64e145845f7f5a3cb20c0520cdaf6dda2f6e025e9b644077202ea7de1232396ba5bde3fee84cdc79604feebe6ba3ec84d464c85d407bb5da99
   languageName: node
   linkType: hard
 
@@ -33931,6 +34070,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"path-scurry@npm:^1.7.0":
+  version: 1.9.2
+  resolution: "path-scurry@npm:1.9.2"
+  dependencies:
+    lru-cache: ^9.1.1
+    minipass: ^5.0.0 || ^6.0.2
+  checksum: 92888dfb68e285043c6d3291c8e971d5d2bc2f5082f4d7b5392896f34be47024c9d0a8b688dd7ae6d125acc424699195474927cb4f00049a9b1ec7c4256fa8e0
+  languageName: node
+  linkType: hard
+
 "path-to-regexp@npm:0.1.7":
   version: 0.1.7
   resolution: "path-to-regexp@npm:0.1.7"
@@ -37286,7 +37435,7 @@ __metadata:
     husky: ^8.0.0
     lint-staged: ^13.0.0
     minimist: ^1.2.5
-    node-gyp: ^9.1.0
+    node-gyp: ^9.4.0
     prettier: ^2.2.1
     semver: ^7.3.2
     shx: ^0.3.2
@@ -37898,6 +38047,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"signal-exit@npm:^4.0.1":
+  version: 4.0.2
+  resolution: "signal-exit@npm:4.0.2"
+  checksum: 41f5928431cc6e91087bf0343db786a6313dd7c6fd7e551dbc141c95bb5fb26663444fd9df8ea47c5d7fc202f60aa7468c3162a9365cbb0615fc5e1b1328fe31
+  languageName: node
+  linkType: hard
+
 "signedsource@npm:^1.0.0":
   version: 1.0.0
   resolution: "signedsource@npm:1.0.0"
@@ -38408,6 +38564,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ssri@npm:^10.0.0":
+  version: 10.0.4
+  resolution: "ssri@npm:10.0.4"
+  dependencies:
+    minipass: ^5.0.0
+  checksum: fb14da9f8a72b04eab163eb13a9dda11d5962cd2317f85457c4e0b575e9a6e0e3a6a87b5bf122c75cb36565830cd5f263fb457571bf6f1587eb5f95d095d6165
+  languageName: node
+  linkType: hard
+
 "ssri@npm:^8.0.0, ssri@npm:^8.0.1":
   version: 8.0.1
   resolution: "ssri@npm:8.0.1"
@@ -38676,6 +38841,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"string-width-cjs@npm:string-width@^4.2.0, string-width@npm:^1.0.2 || 2 || 3 || 4, string-width@npm:^4.1.0, string-width@npm:^4.2.0, string-width@npm:^4.2.3":
+  version: 4.2.3
+  resolution: "string-width@npm:4.2.3"
+  dependencies:
+    emoji-regex: ^8.0.0
+    is-fullwidth-code-point: ^3.0.0
+    strip-ansi: ^6.0.1
+  checksum: e52c10dc3fbfcd6c3a15f159f54a90024241d0f149cf8aed2982a2d801d2e64df0bf1dc351cf8e95c3319323f9f220c16e740b06faecd53e2462df1d2b5443fb
+  languageName: node
+  linkType: hard
+
 "string-width@npm:^1.0.1, string-width@npm:^1.0.2":
   version: 1.0.2
   resolution: "string-width@npm:1.0.2"
@@ -38687,18 +38863,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"string-width@npm:^1.0.2 || 2 || 3 || 4, string-width@npm:^4.1.0, string-width@npm:^4.2.0, string-width@npm:^4.2.3":
-  version: 4.2.3
-  resolution: "string-width@npm:4.2.3"
-  dependencies:
-    emoji-regex: ^8.0.0
-    is-fullwidth-code-point: ^3.0.0
-    strip-ansi: ^6.0.1
-  checksum: e52c10dc3fbfcd6c3a15f159f54a90024241d0f149cf8aed2982a2d801d2e64df0bf1dc351cf8e95c3319323f9f220c16e740b06faecd53e2462df1d2b5443fb
-  languageName: node
-  linkType: hard
-
-"string-width@npm:^5.0.0":
+"string-width@npm:^5.0.0, string-width@npm:^5.0.1, string-width@npm:^5.1.2":
   version: 5.1.2
   resolution: "string-width@npm:5.1.2"
   dependencies:
@@ -38772,6 +38937,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"strip-ansi-cjs@npm:strip-ansi@^6.0.1, strip-ansi@npm:^6.0.0, strip-ansi@npm:^6.0.1":
+  version: 6.0.1
+  resolution: "strip-ansi@npm:6.0.1"
+  dependencies:
+    ansi-regex: ^5.0.1
+  checksum: f3cd25890aef3ba6e1a74e20896c21a46f482e93df4a06567cebf2b57edabb15133f1f94e57434e0a958d61186087b1008e89c94875d019910a213181a14fc8c
+  languageName: node
+  linkType: hard
+
 "strip-ansi@npm:5.2.0":
   version: 5.2.0
   resolution: "strip-ansi@npm:5.2.0"
@@ -38790,15 +38964,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"strip-ansi@npm:^6.0.0, strip-ansi@npm:^6.0.1":
-  version: 6.0.1
-  resolution: "strip-ansi@npm:6.0.1"
-  dependencies:
-    ansi-regex: ^5.0.1
-  checksum: f3cd25890aef3ba6e1a74e20896c21a46f482e93df4a06567cebf2b57edabb15133f1f94e57434e0a958d61186087b1008e89c94875d019910a213181a14fc8c
-  languageName: node
-  linkType: hard
-
 "strip-ansi@npm:^7.0.1":
   version: 7.0.1
   resolution: "strip-ansi@npm:7.0.1"
@@ -40353,6 +40518,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"unique-filename@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "unique-filename@npm:3.0.0"
+  dependencies:
+    unique-slug: ^4.0.0
+  checksum: 8e2f59b356cb2e54aab14ff98a51ac6c45781d15ceaab6d4f1c2228b780193dc70fae4463ce9e1df4479cb9d3304d7c2043a3fb905bdeca71cc7e8ce27e063df
+  languageName: node
+  linkType: hard
+
 "unique-slug@npm:^2.0.0":
   version: 2.0.2
   resolution: "unique-slug@npm:2.0.2"
@@ -40362,6 +40536,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"unique-slug@npm:^4.0.0":
+  version: 4.0.0
+  resolution: "unique-slug@npm:4.0.0"
+  dependencies:
+    imurmurhash: ^0.1.4
+  checksum: 0884b58365af59f89739e6f71e3feacb5b1b41f2df2d842d0757933620e6de08eff347d27e9d499b43c40476cbaf7988638d3acb2ffbcb9d35fd035591adfd15
+  languageName: node
+  linkType: hard
+
 "unist-builder@npm:^3.0.0":
   version: 3.0.0
   resolution: "unist-builder@npm:3.0.0"
@@ -41536,6 +41719,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0, wrap-ansi@npm:^7.0.0":
+  version: 7.0.0
+  resolution: "wrap-ansi@npm:7.0.0"
+  dependencies:
+    ansi-styles: ^4.0.0
+    string-width: ^4.1.0
+    strip-ansi: ^6.0.0
+  checksum: a790b846fd4505de962ba728a21aaeda189b8ee1c7568ca5e817d85930e06ef8d1689d49dbf0e881e8ef84436af3a88bc49115c2e2788d841ff1b8b5b51a608b
+  languageName: node
+  linkType: hard
+
 "wrap-ansi@npm:^2.0.0":
   version: 2.1.0
   resolution: "wrap-ansi@npm:2.1.0"
@@ -41557,14 +41751,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"wrap-ansi@npm:^7.0.0":
-  version: 7.0.0
-  resolution: "wrap-ansi@npm:7.0.0"
+"wrap-ansi@npm:^8.1.0":
+  version: 8.1.0
+  resolution: "wrap-ansi@npm:8.1.0"
   dependencies:
-    ansi-styles: ^4.0.0
-    string-width: ^4.1.0
-    strip-ansi: ^6.0.0
-  checksum: a790b846fd4505de962ba728a21aaeda189b8ee1c7568ca5e817d85930e06ef8d1689d49dbf0e881e8ef84436af3a88bc49115c2e2788d841ff1b8b5b51a608b
+    ansi-styles: ^6.1.0
+    string-width: ^5.0.1
+    strip-ansi: ^7.0.1
+  checksum: 371733296dc2d616900ce15a0049dca0ef67597d6394c57347ba334393599e800bab03c41d4d45221b6bc967b8c453ec3ae4749eff3894202d16800fdfe0e238
   languageName: node
   linkType: hard