maint: final follow-up cherry-pick #9812 (#9907)

* fix(deps): bump transitive deps for 6 Dependabot + remaining audit vulns on main Same overrides as #9464 (ip-address, hono, fast-uri, socket.io-parser, undici) applied directly to main. Also covers brace-expansion (scoped), js-yaml v4 copies, and mermaid. npm audit: 6→0 vulnerabilities. Closes Dependabot #161-#166. * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (#189, #190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot #189, #190. Remaining #182-#188 (js-yaml + mermaid) already closed by #9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * feat(telegram): Mini App chat bridge — initData auth, update webhook, chat proxy Implements the Phase-1 slice of the Telegram Mini App integration (docs/proposals/TELEGRAM-MINIAPP.md): - src/lib/telegram/initData.ts — dependency-free WebApp initData HMAC-SHA256 verification (Telegram Bot API spec), with auth_date freshness check. - src/lib/telegram/config.ts — TELEGRAM_BOT_TOKEN / model / API base / timeout env config; token format validation; enabled gate. - src/lib/telegram/botApi.ts — minimal fetch-based Bot API client (sendMessage, editMessageText, setWebhook) + update shape helpers. - src/lib/telegram/chatProxy.ts — maps a Telegram user to a per-user OmniRoute API key (createApiKey, name telegram:<userId>) and proxies prompts through the existing handleChat pipeline. - src/app/api/telegram/update/route.ts — inbound endpoint serving both the Bot API update webhook (/start + chat replies) and the Mini App direct path (initData HMAC verified → 401 on mismatch). Public route prefix; own auth only. - src/app/miniapp/page.tsx — Telegram WebApp SDK chat UI. - Tests: telegram-init-data (7), telegram-botapi (5) — 12/12 pass. - Env docs: TELEGRAM_* vars in .env.example + ENVIRONMENT.md (sync ✓). - Route-validation check: PASS (body validated via Zod). --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: benzntech <bensonkbmca@gmail.com>
2026-08-19 05:32:19 +03:00 · 2026-08-09 09:50:58 -03:00
parent 3d590c310b
commit 0bb17b91c6
14 changed files with 973 additions and 600 deletions
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
  "name": "omniroute",
-  "version": "3.8.50",
-  "description": "Unified AI router with 290 providers, RTK+Caveman compression, auto fallback, MCP/A2A, desktop, PWA, and OpenAI-compatible APIs.",
+  "version": "3.8.49",
+  "description": "Unified AI router with 160+ providers, RTK+Caveman compression, auto fallback, MCP/A2A, desktop, PWA, and OpenAI-compatible APIs.",
  "type": "module",
  "bin": {
    "omniroute": "bin/omniroute.mjs",
@@ -23,7 +23,6 @@
    ".env.example",
    "scripts/build/postinstall.mjs",
    "scripts/build/fixTlsClientNodeBinary.mjs",
-    "scripts/build/fixPlaywrightAndroid.mjs",
    "bin/cli/runtime/",
    "scripts/postinstall.mjs",
    "scripts/build/postinstallSupport.mjs",
@@ -34,15 +33,11 @@
    "scripts/dev/tls-options.mjs",
    "scripts/check/check-supported-node-runtime.ts",
    "scripts/dev/sync-env.mjs",
-    "scripts/build/assembleStandalone.mjs",
-    "scripts/build/backendOnlyPages.mjs",
-    "scripts/build/build-next-isolated.mjs",
-    "scripts/build/build-tproxy-native.mjs",
    "scripts/build/native-binary-compat.mjs",
+    "scripts/build/build-next-isolated.mjs",
    "scripts/build/runtime-env.mjs",
    "README.md",
    "LICENSE",
-    "!**/node_modules/**",
    "!**/__tests__/**",
    "!**/*.test.ts",
    "!**/*.test.tsx",
@@ -115,8 +110,6 @@
    "test:unit:ci": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 tests/unit/*.test.ts \"tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,db,db-adapters,docs,gamification,guardrails,lib,mcp,memory,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts\" \"tests/unit/**/*.test.mjs\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 \"tests/unit/dashboard/**/*.test.ts\" && npm run test:unit:serial",
    "test:unit:ci:shard": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=4096 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 --test-shard=$TEST_SHARD tests/unit/*.test.ts \"tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,db,db-adapters,docs,gamification,guardrails,lib,mcp,memory,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts\" \"tests/unit/**/*.test.mjs\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=4096 --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 --test-shard=$TEST_SHARD \"tests/unit/dashboard/**/*.test.ts\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=4096 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 --test-shard=$TEST_SHARD \"tests/unit/serial/**/*.test.ts\"",
    "test:unit:fast": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-isolation=none tests/unit/*.test.ts \"tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,db,db-adapters,docs,gamification,guardrails,lib,mcp,memory,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts\" \"tests/unit/**/*.test.mjs\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-isolation=none \"tests/unit/dashboard/**/*.test.ts\" && npm run test:unit:serial",
-    "test:scoped": "bash scripts/quality/test-scoped.sh",
-    "test:scoped:staged": "bash scripts/quality/test-scoped.sh --staged",
    "test:unit:shard": "concurrently --kill-others-on-fail -n s1,s2 \"npm:test:unit:shard:1\" \"npm:test:unit:shard:2\"",
    "test:unit:shard:1": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=10 --test-shard=1/2 tests/unit/*.test.ts \"tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,db,db-adapters,docs,gamification,guardrails,lib,mcp,memory,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts\" \"tests/unit/**/*.test.mjs\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=10 --test-shard=1/2 \"tests/unit/dashboard/**/*.test.ts\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 --test-shard=1/2 \"tests/unit/serial/**/*.test.ts\"",
    "test:unit:shard:2": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=10 --test-shard=2/2 tests/unit/*.test.ts \"tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,db,db-adapters,docs,gamification,guardrails,lib,mcp,memory,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts\" \"tests/unit/**/*.test.mjs\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=10 --test-shard=2/2 \"tests/unit/dashboard/**/*.test.ts\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --max-old-space-size=8192 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 --test-shard=2/2 \"tests/unit/serial/**/*.test.ts\"",
@@ -150,7 +143,6 @@
    "check:node-runtime": "node --import tsx scripts/check/check-supported-node-runtime.ts",
    "check:pack-artifact": "node --import tsx scripts/build/validate-pack-artifact.ts",
    "check:pack-boot": "node scripts/check/check-pack-boot.mjs",
-    "check:install-upgrade": "node scripts/check/check-install-upgrade.mjs",
    "check:pack-policy": "node --import tsx scripts/build/validate-pack-artifact.ts --policy-only",
    "check:cli-i18n": "node scripts/check/check-cli-i18n.mjs",
    "check:openapi-coverage": "node scripts/check/check-openapi-coverage.mjs",
@@ -169,7 +161,6 @@
    "check:test-masking": "node scripts/check/check-test-masking.mjs",
    "check:test-runner-api": "node scripts/check/check-test-runner-api.mjs",
    "check:changelog-integrity": "node scripts/check/check-changelog-integrity.mjs",
-    "sweep:stale-fragments": "node scripts/release/sweep-stale-fragments.mjs",
    "changelog:aggregate": "node scripts/release/aggregate-changelog.mjs",
    "check:agent-skills-sync": "node --import tsx/esm scripts/skills/generate-agent-skills.mjs",
    "check:build-scope": "node scripts/check/check-build-scope.mjs",
@@ -193,7 +184,6 @@
    "check:bundle-size": "node scripts/check/check-bundle-size.mjs",
    "check:circular-deps": "node scripts/check/check-circular-deps.mjs",
    "check:mutation-ratchet": "node scripts/check/check-mutation-ratchet.mjs",
-    "check:rtl-ratchet": "node scripts/check/check-rtl-ratchet.mjs",
    "check:licenses": "node scripts/check/check-licenses.mjs",
    "check:pr-evidence": "node scripts/check/check-pr-evidence.mjs",
    "check:vuln-ratchet": "node scripts/check/check-vuln-ratchet.mjs",
@@ -210,11 +200,9 @@
    "typecheck:core": "tsc --pretty false -p tsconfig.typecheck-core.json",
    "typecheck:noimplicit:core": "tsc --pretty false -p tsconfig.typecheck-noimplicit-core.json",
    "check:dashboard-typecheck": "node scripts/check/check-dashboard-typecheck.mjs",
-    "check:open-sse-typecheck": "node scripts/check/check-open-sse-typecheck.mjs",
    "backfill-aggregation": "node --import tsx src/scripts/backfillAggregation.ts",
    "env:sync": "node scripts/dev/sync-env.mjs",
    "test:integration": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 tests/integration/*.test.ts \"tests/integration/combo-matrix/*.test.ts\"",
-    "test:integration:ci": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 --test-shard=$TEST_SHARD tests/integration/*.test.ts \"tests/integration/combo-matrix/*.test.ts\"",
    "test:combo:matrix": "cross-env DISABLE_SQLITE_AUTO_BACKUP=true node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 \"tests/integration/combo-matrix/*.test.ts\"",
    "test:combo:live": "cross-env RUN_COMBO_LIVE=1 DISABLE_SQLITE_AUTO_BACKUP=true node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 \"tests/integration/combo-live/*.live.test.ts\"",
    "test:combo:live:vps": "node scripts/test/combo-live-vps.mjs",
@@ -244,7 +232,6 @@
    "prepare": "husky",
    "system-info": "node scripts/dev/system-info.mjs",
    "build:cli-api": "node --import tsx/esm scripts/cli/generate-api-commands.mjs",
-    "postbuild": "node scripts/build/colocate-standalone.mjs",
    "release:contributors": "node scripts/release/gen-contributors.mjs",
    "release:uncovered": "node scripts/release/list-uncovered-commits.mjs",
    "test:coverage:runner": "node --max-old-space-size=8192 --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=8 tests/unit/*.test.ts \"tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,db,db-adapters,docs,gamification,guardrails,lib,mcp,memory,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts\" \"tests/unit/**/*.test.mjs\" && cross-env DISABLE_SQLITE_AUTO_BACKUP=true NODE_OPTIONS=--max-old-space-size=8192 c8 --merge-async --output-dir coverage --exclude=tests/** --exclude=**/*.test.* --reporter=text-summary --reporter=html --reporter=json-summary --reporter=lcov --check-coverage --statements 60 --lines 60 --functions 60 --branches 60 node --max-old-space-size=8192 --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=8 \"tests/unit/dashboard/**/*.test.ts\" && npm run test:unit:serial",
@@ -318,7 +305,7 @@
    "sqlite-vec": "^0.1.9",
    "tailwind-merge": "^3.6.0",
    "tsx": "^4.23.0",
-    "undici": "^8.10.0",
+    "undici": "^8.3.0",
    "update-notifier": "^7.3.1",
    "uuid": "^14.0.0",
    "ws": "^8.18.0",
@@ -331,7 +318,7 @@
    "@atjsh/llmlingua-2": "2.0.3",
    "@huggingface/transformers": "3.5.2",
    "@tensorflow/tfjs": "4.22.0",
-    "better-sqlite3": "^13.0.2",
+    "better-sqlite3": "^13.0.1",
    "js-tiktoken": "^1.0.20",
    "keytar": "^7.9.0",
    "tls-client-node": "^0.2.0",
@@ -377,7 +364,6 @@
    "lint-staged": "^17.0.8",
    "lockfile-lint": "^5.0.0",
    "node-loader": "^2.1.0",
-    "opencode-ai": "1.18.8",
    "playwright-ctrf-json-reporter": "^0.0.29",
    "prettier": "^3.8.3",
    "promptfoo": "^0.121.18",
@@ -409,15 +395,6 @@
      "sharp"
    ]
  },
-  "allowScripts": {
-    "better-sqlite3": true,
-    "esbuild": true,
-    "@swc/core": true,
-    "@parcel/watcher": true,
-    "keytar": true,
-    "protobufjs": true,
-    "unrs-resolver": true
-  },
  "overrides": {
    "fast-xml-parser": "^5.10.1",
    "sharp": "^0.35.0",
@@ -448,14 +425,27 @@
    "adm-zip": "^0.6.0",
    "promptfoo": {
      "js-yaml": "^5.2.2",
-      "@apidevtools/json-schema-ref-parser": {
-        "js-yaml": "^4.3.1"
-      },
      "undici": "^7.29.0"
    },
    "socket.io-parser": "^4.2.7",
    "tar": "^7.5.21",
-    "nanoid": "^3.3.17",
+    "brace-expansion": "^5.0.9",
+    "minimatch": {
+      "brace-expansion": "^1.1.18"
+    },
+    "libxmljs2": {
+      "minimatch": {
+        "brace-expansion": "^2.1.4"
+      }
+    },
+    "rimraf": {
+      "minimatch": {
+        "brace-expansion": "^2.1.4"
+      }
+    },
+    "@apidevtools/json-schema-ref-parser": {
+      "js-yaml": "^4.3.1"
+    },
    "@eslint/eslintrc": {
      "js-yaml": "^4.3.1"
    },
@@ -465,11 +455,9 @@
    "xmlbuilder2": {
      "js-yaml": "^4.3.1"
    },
+    "nanoid": "^3.3.17",
    "monaco-editor": {
      "dompurify": "^3.4.13"
-    },
-    "@apidevtools/json-schema-ref-parser": {
-      "js-yaml": "^4.3.1"
    }
  }
 }