fix: make the nginx config readable by the unprivileged user

COPY keeps the source file's mode; a 600 file (local checkouts) left
uid 101 unable to read it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu

.gitea/workflows/ci.yaml

@@ -18,16 +18,30 @@ jobs:
       - name: Build and push
         run: unset GITEA_TOKEN && build && push
 
-  deploy-prod:
+  deploy-prod-frostmoln:
     needs: build
     if: gitea.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     env:
-      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
+      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_FROSTMOLN_PRODUCTION }}
       GITEA_REPOSITORY: ${{ gitea.repository }}
+      FM_TENANT: 9ae61342-0f76-476f-8176-e46f6b0b0c32
     environment: prod
     steps:
       - uses: actions/checkout@v7
       - uses: buildtool/setup-buildtools-action@v1
-      - name: Deploy to production
+      - name: Install fm
-        run: deploy prod
+        run: |
+          sudo install -d -m 0755 /etc/apt/keyrings
+          sudo curl -fsSL -o /etc/apt/keyrings/frostmoln.gpg https://get.frostmoln.cloud/deb/frostmoln.gpg
+          sudo curl -fsSL -o /etc/apt/sources.list.d/frostmoln.sources https://get.frostmoln.cloud/deb/frostmoln.sources
+          sudo apt-get update && sudo apt-get install -y fm
+      - name: Deploy to Frostmoln production
+        env:
+          FROSTMOLN_API_KEY: ${{ secrets.FROSTMOLN_PRODUCTION_DEPLOY_KEY }}
+        # The cluster API is private: the kubeconfig's exec plugin opens an fm
+        # tunnel on demand. fm reads the key from its config file, not the env.
+        run: |
+          fm auth api-key set "$FROSTMOLN_API_KEY" > /dev/null
+          fm kubernetes cluster kubeconfig ${{ vars.FROSTMOLN_PRODUCTION_CLUSTER_ID }} --exec --file "$RUNNER_TEMP/kubeconfig"
+          KUBECONFIG_CONTENT="$(cat "$RUNNER_TEMP/kubeconfig")" deploy prod-frostmoln -n schemas

Dockerfile

@@ -12,9 +12,10 @@ RUN npm run postinstall && npm run generate && npm run lint && npm run test:cove
 FROM scratch as export
 COPY --from=builder /build/coverage /
 
-FROM amd64/nginx:1.31.7@sha256:227f31dac037a2f1cdbd17ca9eec940a76c6c1b3187f5285eca2c3edb5d19c31
+# Unprivileged (uid 101, port 8080): Frostmoln enforces restricted Pod Security.
+FROM nginxinc/nginx-unprivileged:1.31.6@sha256:1d26a516fb93b18f9c0214dc9c645054486e516f13ff09ef63d5bd5c622278a2
 MAINTAINER Joakim Olsson <joakim@unbound.se>
 
-COPY ./nginx/nginx.conf /etc/nginx/nginx.conf
+COPY --chmod=644 ./nginx/nginx.conf /etc/nginx/nginx.conf
-COPY ./nginx/security_headers.conf /etc/nginx/security_headers.conf
+COPY --chmod=644 ./nginx/security_headers.conf /etc/nginx/security_headers.conf
 COPY --from=builder /build/.output/public/ /usr/share/nginx/html/

k8s/deploy.yaml

@@ -23,6 +23,11 @@ spec:
         app.kubernetes.io/name: schemas-app
         app.kubernetes.io/instance: schemas
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 101
+        seccompProfile:
+          type: RuntimeDefault
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -39,19 +44,23 @@ spec:
       - name: schemas-app
         image: ${IMAGE}
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
         ports:
-        - containerPort: 80
+        - containerPort: 8080
         readinessProbe:
           httpGet:
             path: /
-            port: 80
+            port: 8080
           initialDelaySeconds: 5
           periodSeconds: 5
           timeoutSeconds: 5
         livenessProbe:
           httpGet:
             path: /
-            port: 80
+            port: 8080
           initialDelaySeconds: 10
           periodSeconds: 10
           timeoutSeconds: 5
@@ -71,9 +80,8 @@ metadata:
   labels:
     app.kubernetes.io/name: schemas-app
 spec:
-  type: NodePort
   selector:
     app.kubernetes.io/name: schemas-app
   ports:
   - port: 80
-    targetPort: 80
+    targetPort: 8080

k8s/ingress-prod-frostmoln.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: schemas-app
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: "schemas.unbound.se"
+      http:
+        paths:
+          # Everything but /query, which the schemas API's longer path takes.
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: schemas-app
+                port:
+                  number: 80

k8s/ingress-prod.yaml

@@ -1,25 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: schemas-app-ingress
-  annotations:
-    alb.ingress.kubernetes.io/group.name: "default"
-    alb.ingress.kubernetes.io/group.order: "15"
-    alb.ingress.kubernetes.io/scheme: internet-facing
-    alb.ingress.kubernetes.io/target-type: instance
-    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
-    alb.ingress.kubernetes.io/ssl-redirect: "443"
-    alb.ingress.kubernetes.io/healthcheck-path: '/'
-spec:
-  ingressClassName: "alb"
-  rules:
-    - host: "schemas.unbound.se"
-      http:
-        paths:
-          - path: /*
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: schemas-app
-                port:
-                  number: 80

nginx/nginx.conf

@@ -1,14 +1,20 @@
-user  nginx;
 worker_processes  auto;
 
 error_log  /var/log/nginx/error.log notice;
-pid        /var/run/nginx.pid;
+pid        /tmp/nginx.pid;
 
 events {
   worker_connections  1024;
 }
 
 http {
+  # Writable by the unprivileged (uid 101) worker.
+  client_body_temp_path /tmp/client_temp;
+  proxy_temp_path       /tmp/proxy_temp_path;
+  fastcgi_temp_path     /tmp/fastcgi_temp;
+  uwsgi_temp_path       /tmp/uwsgi_temp;
+  scgi_temp_path        /tmp/scgi_temp;
+
   include       /etc/nginx/mime.types;
   default_type  application/octet-stream;
   types {
@@ -22,7 +28,7 @@ http {
   keepalive_timeout  65;
 
   server {
-    listen       80;
+    listen       8080;
     server_name  localhost;
     root         /usr/share/nginx/html;
     index        index.html index.htm;

package-lock.json

@@ -23,7 +23,7 @@
         "@commitlint/cli": "21.2.3",
         "@commitlint/config-conventional": "21.2.3",
         "@graphql-codegen/cli": "7.4.6",
-        "@graphql-codegen/typed-document-node": "7.2.0",
+        "@graphql-codegen/typed-document-node": "7.1.1",
         "@graphql-codegen/typescript": "6.1.2",
         "@graphql-codegen/typescript-operations": "6.1.10",
         "@graphql-codegen/typescript-vue-apollo": "5.0.1",
@@ -32,7 +32,7 @@
         "@nuxtjs/stylelint-module": "5.2.1",
         "@stylistic/eslint-plugin": "5.10.0",
         "@vitejs/plugin-vue": "6.0.10",
-        "@vitest/coverage-v8": "5.0.4",
+        "@vitest/coverage-v8": "5.0.3",
         "@vue/test-utils": "2.5.1",
         "eslint": "10.12.0",
         "eslint-plugin-simple-import-sort": "14.0.0",
@@ -44,7 +44,7 @@
         "stylelint-config-standard": "40.0.0",
         "typescript": "6.0.3",
         "typescript-eslint": "8.71.1",
-        "vitest": "5.0.4",
+        "vitest": "5.0.3",
         "vue-eslint-parser": "10.4.1"
       }
     },
@@ -2841,14 +2841,14 @@
       "license": "MIT"
     },
     "node_modules/@graphql-codegen/typed-document-node": {
-      "version": "7.2.0",
+      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/@graphql-codegen/typed-document-node/-/typed-document-node-7.2.0.tgz",
+      "resolved": "https://registry.npmjs.org/@graphql-codegen/typed-document-node/-/typed-document-node-7.1.1.tgz",
-      "integrity": "sha512-+QS4FeRsUE0WwqdGpBf8CuYUCYtenfnEJ5KBfElv1eRdmooD8MH8Txy5Okk6E8hK75QZ+rAYBf1at2h/4CF1mg==",
+      "integrity": "sha512-wnJ6GX46FDcZevngLJe2aU0BbC3ZsauGjz0O3FJklhfqNGvKGZDFmtmlVvzjJ0RQDmZh2+DH6Qf7dEiXFvmQPQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@graphql-codegen/plugin-helpers": "^7.4.2",
+        "@graphql-codegen/plugin-helpers": "^7.4.0",
-        "@graphql-codegen/visitor-plugin-common": "^7.3.0",
+        "@graphql-codegen/visitor-plugin-common": "^7.2.6",
         "auto-bind": "^5.0.0",
         "change-case-all": "^2.1.0",
         "tslib": "^2.8.0"
@@ -2861,13 +2861,13 @@
       }
     },
     "node_modules/@graphql-codegen/typed-document-node/node_modules/@graphql-codegen/plugin-helpers": {
-      "version": "7.4.2",
+      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/@graphql-codegen/plugin-helpers/-/plugin-helpers-7.4.2.tgz",
+      "resolved": "https://registry.npmjs.org/@graphql-codegen/plugin-helpers/-/plugin-helpers-7.4.0.tgz",
-      "integrity": "sha512-5SmkQvoNg3orbCNWBIv6lD1Zk1/mJbgdqv5oUy2Pw8Q70sO1Y3CGOkdwnPUp5l/pm0GKApQUyqPJkqFaJKewpQ==",
+      "integrity": "sha512-yRvRKsaa3EZMVmrBoOfTbiorGD6D1K459hE7h78/ROsw2jaBPQI3uN/3lG90skZAT+9KuD2roaIbOh+HGpPu7Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@graphql-tools/utils": "^12.0.3",
+        "@graphql-tools/utils": "^11.2.0",
         "change-case-all": "^2.1.0",
         "common-tags": "1.8.2",
         "import-from": "4.0.0",
@@ -2881,16 +2881,16 @@
       }
     },
     "node_modules/@graphql-codegen/typed-document-node/node_modules/@graphql-codegen/visitor-plugin-common": {
-      "version": "7.3.0",
+      "version": "7.2.6",
-      "resolved": "https://registry.npmjs.org/@graphql-codegen/visitor-plugin-common/-/visitor-plugin-common-7.3.0.tgz",
+      "resolved": "https://registry.npmjs.org/@graphql-codegen/visitor-plugin-common/-/visitor-plugin-common-7.2.6.tgz",
-      "integrity": "sha512-XS+VizbHubOXwk6TKK24FLiaicm5p210vufhhpQK78+0ETLhOiMGPBnkz6ieT3OOPJkakKXQoit948ekxE4ohg==",
+      "integrity": "sha512-BHofqv4dnaLlCU9v5Jho9Zonr1TbqWTD8+lS72qpgGdkav1jKvE5W50t5OqKlD6MMqvxHpxolXY0mCH6wdgBZQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@graphql-codegen/plugin-helpers": "^7.4.2",
+        "@graphql-codegen/plugin-helpers": "^7.4.0",
         "@graphql-tools/optimize": "^2.0.0",
-        "@graphql-tools/relay-operation-optimizer": "^7.1.12",
+        "@graphql-tools/relay-operation-optimizer": "^7.1.1",
-        "@graphql-tools/utils": "^12.0.3",
+        "@graphql-tools/utils": "^11.2.0",
         "auto-bind": "^5.0.0",
         "change-case-all": "^2.1.0",
         "dependency-graph": "^1.0.0",
@@ -2905,6 +2905,25 @@
         "graphql": "^0.8.0 || ^0.9.0 || ^0.10.0 || ^0.11.0 || ^0.12.0 || ^0.13.0 || ^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0"
       }
     },
+    "node_modules/@graphql-codegen/typed-document-node/node_modules/@graphql-tools/utils": {
+      "version": "11.2.2",
+      "resolved": "https://registry.npmjs.org/@graphql-tools/utils/-/utils-11.2.2.tgz",
+      "integrity": "sha512-Do2A/t6ayqOma8m7PvpYMsCBswL+NB35BQSng4GWSBqafL2/BnfAZy/NSENPwV721Rm2fG0BHETFC0+FJJZmLw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@graphql-typed-document-node/core": "^3.1.1",
+        "@whatwg-node/promise-helpers": "^1.0.0",
+        "cross-inspect": "1.0.1",
+        "tslib": "^2.4.0"
+      },
+      "engines": {
+        "node": ">=16.0.0"
+      },
+      "peerDependencies": {
+        "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0"
+      }
+    },
     "node_modules/@graphql-codegen/typed-document-node/node_modules/auto-bind": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/auto-bind/-/auto-bind-5.0.1.tgz",
@@ -8076,27 +8095,27 @@
       }
     },
     "node_modules/@vitest/coverage-v8": {
-      "version": "5.0.4",
+      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-5.0.4.tgz",
+      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-5.0.3.tgz",
-      "integrity": "sha512-P5YcQY8Y6RmoE9xRXI38rT8pssbcubEzqtYTM2XQoxOXMDn04nRaTI1SM8qCl9/NfW3ag9GlzdSXu7IwO5Ft8A==",
+      "integrity": "sha512-+klsyz7BvT1vCU28Zkfzms1Ia78XD0V41U3FUtRaa3S+vOr/EXvK1O6BvVD7l1RzEjm6SONR2aybOvDDf9u0mQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@bcoe/v8-coverage": "^1.0.2",
-        "@vitest/istanbul-lib-coverage": "^1.0.2",
+        "@vitest/istanbul-lib-coverage": "^1.0.0",
-        "@vitest/istanbul-lib-report": "^1.0.2",
+        "@vitest/istanbul-lib-report": "^1.0.0",
-        "ast-v8-to-istanbul": "^1.0.7",
+        "ast-v8-to-istanbul": "^1.0.5",
-        "magicast": "^0.5.5",
+        "magicast": "^0.5.4",
-        "obug": "^3.0.0",
+        "obug": "^2.1.4",
-        "std-env": "^4.3.0",
+        "std-env": "^4.2.0",
-        "tinyrainbow": "^3.2.0"
+        "tinyrainbow": "^3.1.1"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       },
       "peerDependencies": {
-        "@vitest/browser": "5.0.4",
+        "@vitest/browser": "5.0.3",
-        "vitest": "5.0.4"
+        "vitest": "5.0.3"
       },
       "peerDependenciesMeta": {
         "@vitest/browser": {
@@ -8104,24 +8123,10 @@
         }
       }
     },
-    "node_modules/@vitest/coverage-v8/node_modules/obug": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/obug/-/obug-3.0.0.tgz",
-      "integrity": "sha512-5vvB5+W7ePv+p3uqxi+RcW1XAzLW0/hxt3/4X4Lc4qHudzOhmBiBwOY6DRob4WnanAEGvNcLjF+KNOufrUoEQw==",
-      "dev": true,
-      "funding": [
-        "https://github.com/sponsors/sxzz",
-        "https://opencollective.com/debug"
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=12.20.0"
-      }
-    },
     "node_modules/@vitest/istanbul-lib-coverage": {
-      "version": "1.0.2",
+      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@vitest/istanbul-lib-coverage/-/istanbul-lib-coverage-1.0.2.tgz",
+      "resolved": "https://registry.npmjs.org/@vitest/istanbul-lib-coverage/-/istanbul-lib-coverage-1.0.1.tgz",
-      "integrity": "sha512-9J/JMwOf9AoJhAywhrn7ScKTL38hsWQP/qPG60OtaAFcQ5OXPwKsxZFlbnuCKmZ61m8/lGgHYnFpdyQZUvG/iA==",
+      "integrity": "sha512-k3DJZ8LhMBK9NS4SclF1ASD3OgXEWDorbIcPTRDK0/Zae6fRvu+fJRxtFdLfHsa9Y24beCdPnoNZ4LviTNstfA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -8129,35 +8134,35 @@
       }
     },
     "node_modules/@vitest/istanbul-lib-report": {
-      "version": "1.0.2",
+      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@vitest/istanbul-lib-report/-/istanbul-lib-report-1.0.2.tgz",
+      "resolved": "https://registry.npmjs.org/@vitest/istanbul-lib-report/-/istanbul-lib-report-1.0.1.tgz",
-      "integrity": "sha512-gUsfXZJbzPamoIY5TvHFiMMoXESBrUMo+xqaj+rYrWI69+EnvRlYBlP96ZnHPY4vX8kyUpgAnFUCg5wZG/HkDQ==",
+      "integrity": "sha512-1EOLRfsTMnyAr3+kEAsP4o9dhaDlGPpD7H5iLBBeq//YpNB1VIahkPhB+eRp9N2Dkfw8oySROjE3yf9XDeaIkQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/istanbul-lib-coverage": "1.0.2"
+        "@vitest/istanbul-lib-coverage": "1.0.1"
       },
       "engines": {
         "node": ">=22"
       }
     },
     "node_modules/@vitest/mocker": {
-      "version": "5.0.4",
+      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-5.0.4.tgz",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-5.0.3.tgz",
-      "integrity": "sha512-tqAlrYWce4iUxhr3ncNohejtCTOcHeE8XWrSNZY3OhPoDn01yeGv+gnaBy64ATp7o6pb03eIbBAjzmibpc9vIQ==",
+      "integrity": "sha512-T8sWAIbkSyAjkwTcaEc3Iu0o9A27X1/kdXrizhZkGuSKScRQtRzclfAMpOTcGdXCsqxeWlpGy3XjqaW8CpLORg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/trace-mapping": "0.3.31",
-        "@vitest/spy": "5.0.4",
+        "@vitest/spy": "5.0.3",
         "estree-walker": "^3.0.3",
-        "magic-string": "^1.4.3"
+        "magic-string": "^1.2.3"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       },
       "peerDependencies": {
-        "msw": "^2.4.9 || ^3.0.0",
+        "msw": "^2.4.9",
         "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
       },
       "peerDependenciesMeta": {
@@ -8180,19 +8185,19 @@
       }
     },
     "node_modules/@vitest/mocker/node_modules/magic-string": {
-      "version": "1.4.3",
+      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.3.tgz",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.2.3.tgz",
-      "integrity": "sha512-z12OxmaPGE0F4xlpGdjuAUckipLpQlTAuAmyGhNoD7ODpYUzvDfvtxUbjM/jwznyP178oju/KDdyi220wNJ0RQ==",
+      "integrity": "sha512-Bpb0W2TbLKOZ7vJnOUnVRGq3WL2p+ISV29M6hYPL1AFCpyKZpdr5ytiXoTSSxRVhg8YW7f65+6gbG8WG6PCa/g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.6.0"
+        "@jridgewell/sourcemap-codec": "^1.5.5"
       }
     },
     "node_modules/@vitest/spy": {
-      "version": "5.0.4",
+      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-5.0.4.tgz",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-5.0.3.tgz",
-      "integrity": "sha512-MZKk/gSkm2q+ICobMxCpH1mA+cCAWm8WV7UhxlqGjq/sJ3AGc1BqFOs5CRVXxH78wQtme9q/NAAgBquj4AcyMw==",
+      "integrity": "sha512-XhFysQTB8AZ+P4gMi+Lpo99vg2AZi0qKpaB9yXQl37+CaMEAPO3iH/wGVnSyL5MPERiLezpqTVtrR6UZH5GCXg==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -9123,9 +9128,9 @@
       }
     },
     "node_modules/ast-v8-to-istanbul": {
-      "version": "1.0.7",
+      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/ast-v8-to-istanbul/-/ast-v8-to-istanbul-1.0.7.tgz",
+      "resolved": "https://registry.npmjs.org/ast-v8-to-istanbul/-/ast-v8-to-istanbul-1.0.5.tgz",
-      "integrity": "sha512-kFL68AG6ajd8fg248zwM9GQrUWEp79gsmjum34OEXjs4yHuUMZfYKwOLW9GMmB4oNvVrj+EAGxsP7ye2UR9UlA==",
+      "integrity": "sha512-UPAgKJFSEGMWSDr3LX4tqnAb4f7KGT8O40Tyx8wbYmmZ/yn58lNCm8h3svs3eXgiGd5AXxz8NDOvXWvicq+rJA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9778,9 +9783,9 @@
       }
     },
     "node_modules/chai": {
-      "version": "6.3.0",
+      "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/chai/-/chai-6.3.0.tgz",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
-      "integrity": "sha512-XWAtwJ6OHO+tj0EKCs0Y2UamnyOxseZWltU4x2U2wh8g4AigdjwvtUjvLP2tqkA/avxHEtzxNaqGq/YGNwckKg==",
+      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15373,9 +15378,9 @@
       }
     },
     "node_modules/magicast": {
-      "version": "0.5.5",
+      "version": "0.5.4",
-      "resolved": "https://registry.npmjs.org/magicast/-/magicast-0.5.5.tgz",
+      "resolved": "https://registry.npmjs.org/magicast/-/magicast-0.5.4.tgz",
-      "integrity": "sha512-UicdXN8zQ3JHlxVq+28afMXPr1z7WNY6+7EJnzTdQWkTAlMLF5fNCCKxJHBQwGaNGR11581EiQmQzx73+MvszA==",
+      "integrity": "sha512-llBEhWm1SacoRwgHUoQJYtwp4PBLF4faQi5TCpIGyGs9n4y5+juI0tDgyKIfpqxckRHaHzouUEph3THklWh03w==",
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "^7.29.7",
@@ -20023,9 +20028,9 @@
       "license": "MIT"
     },
     "node_modules/tinybench": {
-      "version": "6.2.2",
+      "version": "6.1.4",
-      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-6.2.2.tgz",
+      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-6.1.4.tgz",
-      "integrity": "sha512-nIZ2N2dFpjBsg2hgitKu7mA+FvsIJuGJOwysRngmVRRmWgR/UyPjwJj8c/fT/dhm8EkHnF5EOogRf+0Z2qrimA==",
+      "integrity": "sha512-9APumHG7r4yOk4X4WlkmE71aZcv1gvin1czO3OQ1U9iJcFA5Ja/ygyb0vPOVHTthFozUYs8CLoLUlM8grb2lTQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20067,9 +20072,9 @@
       }
     },
     "node_modules/tinyrainbow": {
-      "version": "3.2.0",
+      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.2.0.tgz",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.1.tgz",
-      "integrity": "sha512-LgO3D9yZJjApUiuUfl9iFAwrtaX4+lok3wJIqttGoKCHlWUqHqbQpnxCf82L8FjgKsh4iGo78hqJwgL8F6To2A==",
+      "integrity": "sha512-yau8yJdTt989Mm0Bd/236QnzEiPf2xLLTqUZRUJOo/3CB078LSwzei343DgtJVmfJKJE3TMINY1u42SQsP6mXw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -21790,23 +21795,23 @@
       }
     },
     "node_modules/vitest": {
-      "version": "5.0.4",
+      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-5.0.4.tgz",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-5.0.3.tgz",
-      "integrity": "sha512-z0WxZRV2Sg48wF0FSgMq3TFG8JS38/Qr96vZVZdX6+Em9raQTvnXQvdTFJe2m3rfyJnEHeHQ/snceIdi8D1pVg==",
+      "integrity": "sha512-xMw97S3rjdtj5dkVat7jCsqWBpvchs3RlpQctUqwJD0KkERk40vz2fJ77lDwW/Vzh/pk18eItYAzkodhSes3jQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/chai": "^5.2.2",
-        "@vitest/mocker": "5.0.4",
+        "@vitest/mocker": "5.0.3",
-        "chai": "^6.3.0",
+        "chai": "^6.2.2",
         "es-module-lexer": "^2.3.2",
         "expect-type": "^1.4.0",
-        "magic-string": "^1.4.3",
+        "magic-string": "^1.2.3",
-        "obug": "^3.0.0",
+        "obug": "^2.1.4",
         "picomatch": "^4.0.7",
-        "std-env": "^4.3.0",
+        "std-env": "^4.2.0",
-        "tinybench": "^6.2.2",
+        "tinybench": "^6.1.4",
-        "tinyexec": "^1.3.1",
+        "tinyexec": "^1.3.0",
         "tinyglobby": "^0.2.17",
         "why-is-node-running": "3.2.1"
       },
@@ -21823,12 +21828,12 @@
         "@edge-runtime/vm": "*",
         "@opentelemetry/api": "^1.9.0",
         "@types/node": "^22.0.0 || >=24.0.0",
-        "@vitest/browser-playwright": "5.0.4",
+        "@vitest/browser-playwright": "5.0.3",
-        "@vitest/browser-preview": "5.0.4",
+        "@vitest/browser-preview": "5.0.3",
         "@vitest/browser-webdriverio": "^5.0.0-beta.5 || >=5.0.0",
-        "@vitest/coverage-istanbul": "5.0.4",
+        "@vitest/coverage-istanbul": "5.0.3",
-        "@vitest/coverage-v8": "5.0.4",
+        "@vitest/coverage-v8": "5.0.3",
-        "@vitest/ui": "5.0.4",
+        "@vitest/ui": "5.0.3",
         "happy-dom": "*",
         "jsdom": "*",
         "vite": "^6.4.0 || ^7.0.0 || ^8.0.0"
@@ -21880,27 +21885,26 @@
       "license": "MIT"
     },
     "node_modules/vitest/node_modules/magic-string": {
-      "version": "1.4.3",
+      "version": "1.4.2",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.3.tgz",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.2.tgz",
-      "integrity": "sha512-z12OxmaPGE0F4xlpGdjuAUckipLpQlTAuAmyGhNoD7ODpYUzvDfvtxUbjM/jwznyP178oju/KDdyi220wNJ0RQ==",
+      "integrity": "sha512-vG+rjFRj1PqdIBozIxAGMjPlOhaVe+GXpbttY/iSK7rGcJRMlwNJO7dcUwmUqkymsFLJiNGI06t4D7Fr7yRC9g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/sourcemap-codec": "^1.6.0"
       }
     },
-    "node_modules/vitest/node_modules/obug": {
+    "node_modules/vitest/node_modules/why-is-node-running": {
-      "version": "3.0.0",
+      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/obug/-/obug-3.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-3.2.1.tgz",
-      "integrity": "sha512-5vvB5+W7ePv+p3uqxi+RcW1XAzLW0/hxt3/4X4Lc4qHudzOhmBiBwOY6DRob4WnanAEGvNcLjF+KNOufrUoEQw==",
+      "integrity": "sha512-Tb2FUhB4vUsGQlfSquQLYkApkuPAFQXGFzxWKHHumVz2dK+X1RUm/HnID4+TfIGYJ1kTcwOaCk/buYCEJr6YjQ==",
       "dev": true,
-      "funding": [
-        "https://github.com/sponsors/sxzz",
-        "https://opencollective.com/debug"
-      ],
       "license": "MIT",
+      "bin": {
+        "why-is-node-running": "cli.js"
+      },
       "engines": {
-        "node": ">=12.20.0"
+        "node": ">=20.11"
       }
     },
     "node_modules/vue": {
@@ -22381,19 +22385,6 @@
         "node": "^20.17.0 || >=22.9.0"
       }
     },
-    "node_modules/why-is-node-running": {
-      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-3.2.1.tgz",
-      "integrity": "sha512-Tb2FUhB4vUsGQlfSquQLYkApkuPAFQXGFzxWKHHumVz2dK+X1RUm/HnID4+TfIGYJ1kTcwOaCk/buYCEJr6YjQ==",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "why-is-node-running": "cli.js"
-      },
-      "engines": {
-        "node": ">=20.11"
-      }
-    },
     "node_modules/word-wrap": {
       "version": "1.2.5",
       "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",

package.json

@@ -37,7 +37,7 @@
     "@commitlint/cli": "21.2.3",
     "@commitlint/config-conventional": "21.2.3",
     "@graphql-codegen/cli": "7.4.6",
-    "@graphql-codegen/typed-document-node": "7.2.0",
+    "@graphql-codegen/typed-document-node": "7.1.1",
     "@graphql-codegen/typescript": "6.1.2",
     "@graphql-codegen/typescript-operations": "6.1.10",
     "@graphql-codegen/typescript-vue-apollo": "5.0.1",
@@ -46,7 +46,7 @@
     "@nuxtjs/stylelint-module": "5.2.1",
     "@stylistic/eslint-plugin": "5.10.0",
     "@vitejs/plugin-vue": "6.0.10",
-    "@vitest/coverage-v8": "5.0.4",
+    "@vitest/coverage-v8": "5.0.3",
     "@vue/test-utils": "2.5.1",
     "eslint": "10.12.0",
     "eslint-plugin-simple-import-sort": "14.0.0",
@@ -58,7 +58,7 @@
     "stylelint-config-standard": "40.0.0",
     "typescript": "6.0.3",
     "typescript-eslint": "8.71.1",
-    "vitest": "5.0.4",
+    "vitest": "5.0.3",
     "vue-eslint-parser": "10.4.1"
   },
   "overrides": {