From c66cd6e719ad2f9e9dc22abba7ac84cfc00af661 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 20 Sep 2026 18:40:38 +0000 Subject: [PATCH 1/3] chore(deps): update dependency zod to v4.6.5 (#704) * Allow HackPSU's own Cloud Run origins to authenticate (#705) Gavel now runs on Cloud Run at gavel-production-695455897614.us-east4.run.app. That origin was not in the allowlist, so resolveReturnTo discarded it and sent users to hackpsu.org instead -- login could start but never come back. Scoped to our project rather than to .run.app as a whole. Cloud Run derives its hostname as -..run.app, so the project number identifies the owner; allowing .run.app outright would let anyone deploy a service and have buildReturnUrl hand it a session token, which is the same class of problem resolveReturnTo exists to prevent. A service in another project cannot forge it: naming theirs foo-695455897614 yields foo-695455897614-..run.app, whose first label ends with their number, not ours. The number is overridable via CLOUD_RUN_PROJECT_NUMBER. Classified as staging rather than falling through to local, because Cloud Run is a real HTTPS deployment whose cookies must be marked Secure, but is not on hackpsu.org so it cannot read the shared session cookie and has to use the token handoff -- exactly what staging already means here. Co-authored-by: Claude Opus 5 (1M context) * chore(deps): update dependency zod to v4.6.5 --------- Co-authored-by: Kanishk Sachdev <64576646+kensac@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index b1dfd5d..9e89db7 100644 --- a/yarn.lock +++ b/yarn.lock @@ -4949,6 +4949,6 @@ yocto-queue@^0.1.0: integrity sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q== zod@^4.0.5: - version "4.6.2" - resolved "https://registry.yarnpkg.com/zod/-/zod-4.6.2.tgz#91b2ce79ec994eaa42675499166587d3d223c961" - integrity sha512-lh5RCAGFa1Cm2hjtNwLQhSs/AsqdWnTQaBER9fEwN/88pSh7KOtJavtBx/0VlkN/uFd61SwYmljLMDAsHlvzBQ== + version "4.6.5" + resolved "https://registry.yarnpkg.com/zod/-/zod-4.6.5.tgz#e3af3edbdc260239c52f73caad05dbbffe6e82cd" + integrity sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q== From ab1485447f82ae69cac07240a9490d9058115a60 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 20 Sep 2026 21:28:07 +0000 Subject: [PATCH 2/3] chore(deps): update dependency posthog-js to v1.434.2 (#706) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- yarn.lock | 46 +++++++++++++++++----------------------------- 1 file changed, 17 insertions(+), 29 deletions(-) diff --git a/yarn.lock b/yarn.lock index 9e89db7..840b6af 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1179,34 +1179,22 @@ tslib "^2.8.1" tsyringe "^4.10.0" -"@posthog/browser-common@^0.8.3": - version "0.8.3" - resolved "https://registry.yarnpkg.com/@posthog/browser-common/-/browser-common-0.8.3.tgz#19ca2563383f2f3f1a01cc706ac94514c1956f6c" - integrity sha512-4Hlbwyn+Hioc2+pjqSGWMTDrA5XsDshssPnGfv34khPKoJaeBe2YvPvsEPoH78jezOS6Wo3LJvCPhqyolg3S8w== +"@posthog/browser-common@^0.9.0": + version "0.9.0" + resolved "https://registry.yarnpkg.com/@posthog/browser-common/-/browser-common-0.9.0.tgz#329c5de42123aaafa4953f2ebde6bbd4e44aabe1" + integrity sha512-EWoVzs1vVY7ihpn8yOjj3jyjriHUEEMVSBNL/TW3hk09fTriWRe76vJXrRg0G0yjTYxHmtlSkNn4mOV24ZEzzA== dependencies: - "@posthog/core" "^1.53.2" - "@posthog/types" "^1.411.1" - -"@posthog/core@^1.53.2": - version "1.53.2" - resolved "https://registry.yarnpkg.com/@posthog/core/-/core-1.53.2.tgz#be92f21bedbaf6bba36c6b5583dc2f49d92bf38e" - integrity sha512-Knx8442G2LyPVIzLvhcBX/TIdeHpZhrYrtZou3Uw8FWfbr9gQtQeOZDCog3MWcDxJ+4vAnMAAOzf5cYpc7Gxyw== - dependencies: - "@posthog/types" "^1.411.1" + "@posthog/core" "^1.54.2" + "@posthog/types" "^1.412.1" -"@posthog/core@^1.54.2": +"@posthog/core@^1.54.2", "@posthog/core@^1.55.0": version "1.55.0" resolved "https://registry.yarnpkg.com/@posthog/core/-/core-1.55.0.tgz#8b97b38fb9f970664b4a1893aed834eed8a1a8d2" integrity sha512-x+0FR+uHsK3uJeofd5X4S2YS7hjaWkzkPN0X1GROHm9SvKw2RJ91kfQ7gT1bPtFwZSHNiRtteB7fX/xEMRN0IQ== dependencies: "@posthog/types" "^1.412.2" -"@posthog/types@^1.411.1": - version "1.411.1" - resolved "https://registry.yarnpkg.com/@posthog/types/-/types-1.411.1.tgz#4ba362e2dd81eb4e91a523125876dce4a8479125" - integrity sha512-Gd7tnSYctcSXup3naVlAgavvenByRao6rsSYdMgWgP35KE9jFn+rMHNRJeI5LNjJuLzMXHEVcgzAN7xcATefdw== - -"@posthog/types@^1.412.2": +"@posthog/types@^1.412.1", "@posthog/types@^1.412.2": version "1.412.2" resolved "https://registry.yarnpkg.com/@posthog/types/-/types-1.412.2.tgz#5148fdc9f9b54e02b57141baae4f7fa09ea57520" integrity sha512-taxTh8o6n7ZVlC8qBypZvF+6w7/18yNkS9XDiGCbutGTKqIljfzYi/7pumgwN3mcnl/n0e9A+JhF05+nLd4Xaw== @@ -3993,13 +3981,13 @@ postcss@^8.5.16: source-map-js "^1.2.1" posthog-js@^1.257.0: - version "1.430.3" - resolved "https://registry.yarnpkg.com/posthog-js/-/posthog-js-1.430.3.tgz#f105cb4b39f46abec8ea5c1edbe193bbc867bdd7" - integrity sha512-+j/0wa36fXdXsiKhN7ghHOA4z9/ik893ZpMOLeqCluqXZSt/oe+iClIavWqLRcYhvvmJvl2D3EfKpt8Kg8GbUQ== + version "1.434.2" + resolved "https://registry.yarnpkg.com/posthog-js/-/posthog-js-1.434.2.tgz#168ec1113f6da89adab4b338dfb66cd5a66c9738" + integrity sha512-xyvjj88U2Cp1JfDzmifLvNbdiY/z+YbTT1DaRRKRZ+qzaF9IKqMLumpv8jTKGh6y3m4vc3xz0ku8h5Tw0XU9zQ== dependencies: - "@posthog/browser-common" "^0.8.3" - "@posthog/core" "^1.53.2" - "@posthog/types" "^1.411.1" + "@posthog/browser-common" "^0.9.0" + "@posthog/core" "^1.55.0" + "@posthog/types" "^1.412.2" core-js "^3.49.0" dompurify "^3.4.13" fflate "^0.4.8" @@ -4800,9 +4788,9 @@ web-vitals@^4.2.4: integrity sha512-r4DIlprAGwJ7YM11VZp4R884m0Vmgr6EAKe3P+kO0PPj3Unqyvv59rczf6UiGcb9Z8QxZVcqKNwv/g0WNdWwsw== web-vitals@^6.2.1: - version "6.2.1" - resolved "https://registry.yarnpkg.com/web-vitals/-/web-vitals-6.2.1.tgz#1a5c857ceffc8cc25d3977f91b05f2a37505353c" - integrity sha512-rLcLXA2sx6+9dE88NHFubwTtGxpK4yYBLj6qHPdFoCaLr0cXGb4efOqtKLlm4loGA4OEKHIQKMKzZkKyOh5ctw== + version "6.2.2" + resolved "https://registry.yarnpkg.com/web-vitals/-/web-vitals-6.2.2.tgz#ff4a7a8d7c5df18074a01f1c4f169e1a57df7193" + integrity sha512-oto5x6dLEgrRqfcWed+pZEUb2q6ikbFmqF54CRDhI/QGbn+qxC49b4C4OkbH+kb9C3a8shpFD3SgR9kRcs80ZQ== webidl-conversions@^3.0.0: version "3.0.1" From cb62c6571a855a17030ae907120821036f8b8254 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 20 Sep 2026 21:28:36 +0000 Subject: [PATCH 3/3] chore(deps): update dependency @types/node to v24 --- package.json | 2 +- yarn.lock | 18 +++++++++--------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/package.json b/package.json index 96ae852..aee5eac 100644 --- a/package.json +++ b/package.json @@ -34,7 +34,7 @@ "devDependencies": { "@eslint/eslintrc": "^3", "@tailwindcss/postcss": "^4", - "@types/node": "^22.0.0", + "@types/node": "^24.0.0", "@types/react": "^19", "@types/react-dom": "^19", "eslint": "^9", diff --git a/yarn.lock b/yarn.lock index 840b6af..0dced45 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1493,12 +1493,12 @@ dependencies: undici-types "~8.9.0" -"@types/node@^22.0.0": - version "22.20.4" - resolved "https://registry.yarnpkg.com/@types/node/-/node-22.20.4.tgz#37aab5e1beb215f4c036ea0e17343e59abf430de" - integrity sha512-zJRE40jpHtKqE/C4fgHrAKQLJuSpzEnP9ff9Y7YtoR3Wd2pwqzlekDeEuUQXjRd+QCYnVnNwuJYmhdk9XV8gvA== +"@types/node@^24.0.0": + version "24.13.6" + resolved "https://registry.yarnpkg.com/@types/node/-/node-24.13.6.tgz#30ba2d8aae3c321fd170fe52a915231a67a4875c" + integrity sha512-SGrw/h3KPFshy3OE6ZL53LMBG5vGQQ8/gIpiqz/kRZhPJ7HgwCEs8LBuNtWLa8dvGZVpSF7+Bf+c11HUrCb/yg== dependencies: - undici-types "~6.21.0" + undici-types "~7.18.0" "@types/react-dom@^19": version "19.3.0" @@ -4713,10 +4713,10 @@ unbox-primitive@^1.1.0: resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-7.24.6.tgz#61275b485d7fd4e9d269c7cf04ec2873c9cc0f91" integrity sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg== -undici-types@~6.21.0: - version "6.21.0" - resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-6.21.0.tgz#691d00af3909be93a7faa13be61b3a5b50ef12cb" - integrity sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ== +undici-types@~7.18.0: + version "7.18.2" + resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-7.18.2.tgz#29357a89e7b7ca4aef3bf0fd3fd0cd73884229e9" + integrity sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w== undici-types@~8.9.0: version "8.9.0"