xixu-me
9e24204f63
feat(security): harden dependency governance
2026-03-31 01:36:17 +08:00
dependabot[bot]
c5b0b9d84f
chore(deps): bump archiver and @types/archiver ( #32 )
...
Bumps [archiver](https://github.com/archiverjs/node-archiver ) and [@types/archiver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/archiver ). These dependencies needed to be updated together.
Updates `archiver` from 6.0.2 to 7.0.1
- [Release notes](https://github.com/archiverjs/node-archiver/releases )
- [Changelog](https://github.com/archiverjs/node-archiver/blob/master/CHANGELOG.md )
- [Commits](https://github.com/archiverjs/node-archiver/compare/6.0.2...7.0.1 )
Updates `@types/archiver` from 5.3.4 to 7.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/archiver )
---
updated-dependencies:
- dependency-name: archiver
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-major
- dependency-name: "@types/archiver"
dependency-version: 7.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-30 14:24:12 +00:00
dependabot[bot]
a9076d72b9
chore(deps): bump jose from 5.2.4 to 6.2.2 ( #30 )
...
Bumps [jose](https://github.com/panva/jose ) from 5.2.4 to 6.2.2.
- [Release notes](https://github.com/panva/jose/releases )
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md )
- [Commits](https://github.com/panva/jose/compare/v5.2.4...v6.2.2 )
---
updated-dependencies:
- dependency-name: jose
dependency-version: 6.2.2
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-30 14:21:54 +00:00
xixu-me
ac349eae97
fix(runtime): harden standalone cold starts
2026-03-30 22:19:27 +08:00
dependabot[bot]
1542a67ba3
chore(deps): bump the production-dependencies group with 12 updates ( #22 )
...
Bumps the production-dependencies group with 12 updates:
| Package | From | To |
| --- | --- | --- |
| [@napi-rs/canvas](https://github.com/Brooooooklyn/canvas ) | `0.1.68` | `0.1.97` |
| [@xmldom/xmldom](https://github.com/xmldom/xmldom ) | `0.9.3` | `0.9.9` |
| [axios](https://github.com/axios/axios ) | `1.13.5` | `1.14.0` |
| [cors](https://github.com/expressjs/cors ) | `2.8.5` | `2.8.6` |
| [dayjs](https://github.com/iamkun/dayjs ) | `1.11.10` | `1.11.20` |
| [koa](https://github.com/koajs/koa ) | `2.16.0` | `2.16.4` |
| [koa-compress](https://github.com/koajs/compress ) | `5.1.1` | `5.2.1` |
| [linkedom](https://github.com/WebReflection/linkedom ) | `0.18.4` | `0.18.12` |
| [lru-cache](https://github.com/isaacs/node-lru-cache ) | `11.0.2` | `11.2.7` |
| [tiktoken](https://github.com/dqbd/tiktoken ) | `1.0.16` | `1.0.22` |
| [turndown](https://github.com/mixmark-io/turndown ) | `7.1.3` | `7.2.2` |
| [undici](https://github.com/nodejs/undici ) | `7.24.0` | `7.24.6` |
Updates `@napi-rs/canvas` from 0.1.68 to 0.1.97
- [Release notes](https://github.com/Brooooooklyn/canvas/releases )
- [Changelog](https://github.com/Brooooooklyn/canvas/blob/main/CHANGELOG.md )
- [Commits](https://github.com/Brooooooklyn/canvas/compare/v0.1.68...v0.1.97 )
Updates `@xmldom/xmldom` from 0.9.3 to 0.9.9
- [Release notes](https://github.com/xmldom/xmldom/releases )
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md )
- [Commits](https://github.com/xmldom/xmldom/compare/0.9.3...0.9.9 )
Updates `axios` from 1.13.5 to 1.14.0
- [Release notes](https://github.com/axios/axios/releases )
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md )
- [Commits](https://github.com/axios/axios/compare/v1.13.5...v1.14.0 )
Updates `cors` from 2.8.5 to 2.8.6
- [Release notes](https://github.com/expressjs/cors/releases )
- [Changelog](https://github.com/expressjs/cors/blob/master/HISTORY.md )
- [Commits](https://github.com/expressjs/cors/compare/v2.8.5...v2.8.6 )
Updates `dayjs` from 1.11.10 to 1.11.20
- [Release notes](https://github.com/iamkun/dayjs/releases )
- [Changelog](https://github.com/iamkun/dayjs/blob/dev/CHANGELOG.md )
- [Commits](https://github.com/iamkun/dayjs/compare/v1.11.10...v1.11.20 )
Updates `koa` from 2.16.0 to 2.16.4
- [Release notes](https://github.com/koajs/koa/releases )
- [Changelog](https://github.com/koajs/koa/blob/master/History.md )
- [Commits](https://github.com/koajs/koa/compare/2.16.0...v2.16.4 )
Updates `koa-compress` from 5.1.1 to 5.2.1
- [Release notes](https://github.com/koajs/compress/releases )
- [Changelog](https://github.com/koajs/compress/blob/master/HISTORY.md )
- [Commits](https://github.com/koajs/compress/compare/v5.1.1...5.2.1 )
Updates `linkedom` from 0.18.4 to 0.18.12
- [Commits](https://github.com/WebReflection/linkedom/compare/v0.18.4...v0.18.12 )
Updates `lru-cache` from 11.0.2 to 11.2.7
- [Changelog](https://github.com/isaacs/node-lru-cache/blob/main/CHANGELOG.md )
- [Commits](https://github.com/isaacs/node-lru-cache/compare/v11.0.2...v11.2.7 )
Updates `tiktoken` from 1.0.16 to 1.0.22
- [Release notes](https://github.com/dqbd/tiktoken/releases )
- [Changelog](https://github.com/dqbd/tiktoken/blob/main/CHANGELOG.md )
- [Commits](https://github.com/dqbd/tiktoken/compare/tiktoken@1.0.16...tiktoken@1.0.22 )
Updates `turndown` from 7.1.3 to 7.2.2
- [Release notes](https://github.com/mixmark-io/turndown/releases )
- [Commits](https://github.com/mixmark-io/turndown/compare/v7.1.3...v7.2.2 )
Updates `undici` from 7.24.0 to 7.24.6
- [Release notes](https://github.com/nodejs/undici/releases )
- [Commits](https://github.com/nodejs/undici/compare/v7.24.0...v7.24.6 )
---
updated-dependencies:
- dependency-name: "@napi-rs/canvas"
dependency-version: 0.1.97
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: "@xmldom/xmldom"
dependency-version: 0.9.9
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: axios
dependency-version: 1.14.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: cors
dependency-version: 2.8.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: dayjs
dependency-version: 1.11.20
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: koa
dependency-version: 2.16.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: koa-compress
dependency-version: 5.2.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: linkedom
dependency-version: 0.18.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: lru-cache
dependency-version: 11.2.7
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: tiktoken
dependency-version: 1.0.22
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
- dependency-name: turndown
dependency-version: 7.2.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: production-dependencies
- dependency-name: undici
dependency-version: 7.24.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: production-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-30 01:15:59 +00:00
3adc9b2940
chore(deps): bump axios from 1.7.7 to 1.13.5 ( #2 )
...
Bumps [axios](https://github.com/axios/axios ) from 1.7.7 to 1.13.5.
- [Release notes](https://github.com/axios/axios/releases )
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md )
- [Commits](https://github.com/axios/axios/compare/v1.7.7...v1.13.5 )
---
updated-dependencies:
- dependency-name: axios
dependency-version: 1.13.5
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xi Xu <i@xi-xu.me >
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-03-30 01:17:09 +08:00
dependabot[bot] and xixu-me
b51596e8d6
chore(deps): bump undici from 7.8.0 to 7.24.0 ( #17 )
...
Bumps [undici](https://github.com/nodejs/undici ) from 7.8.0 to 7.24.0.
- [Release notes](https://github.com/nodejs/undici/releases )
- [Commits](https://github.com/nodejs/undici/compare/v7.8.0...v7.24.0 )
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.24.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xi Xu <i@xi-xu.me >
2026-03-29 17:00:20 +00:00
xixu-me
301854727b
feat(repo): make xread standalone and self-hostable
...
Replace private shared dependencies with local implementations, keep the standalone crawl/search/serp build working, and add CI, GHCR image publishing, Dependabot updates, and green-only auto-merge automation.
2026-03-29 23:44:16 +08:00
xixu-me
ec8f135392
Initial commit
2026-03-29 21:39:05 +08:00
xixu-me
dependabot[bot]