Bump tar and npm

Removes [tar](https://github.com/isaacs/node-tar). It's no longer used after updating ancestor dependency [npm](https://github.com/npm/cli). These dependencies need to be updated together. Removes `tar` Updates `npm` from 11.7.0 to 11.8.0 - [Release notes](https://github.com/npm/cli/releases) - [Changelog](https://github.com/npm/cli/blob/latest/CHANGELOG.md) - [Commits](https://github.com/npm/cli/compare/v11.7.0...v11.8.0) --- updated-dependencies: - dependency-name: tar dependency-version: dependency-type: indirect - dependency-name: npm dependency-version: 11.8.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
2026-02-01 15:49:08 +00:00 · 2026-01-26 01:37:31 +00:00
5 changed files with 71 additions and 153 deletions
--- a/.github/workflows/cicd.yml
+++ b/.github/workflows/cicd.yml
@@ -504,55 +504,10 @@ jobs:
                      }

                      echo "==> cosign verify (public key) ${REF}"
-                      if retry_verify "cosign verify --key env://COSIGN_PUBLIC_KEY '${REF}' -o text"; then
-                        VERIFIED_INDEX=true
-                      else
-                        VERIFIED_INDEX=false
-                      fi
+                      retry_verify "cosign verify --key env://COSIGN_PUBLIC_KEY '${REF}' -o text"

                      echo "==> cosign verify (keyless policy) ${REF}"
-                      if retry_verify "cosign verify --certificate-oidc-issuer '${issuer}' --certificate-identity-regexp '${id_regex}' '${REF}' -o text"; then
-                        VERIFIED_INDEX_KEYLESS=true
-                      else
-                        VERIFIED_INDEX_KEYLESS=false
-                      fi
-
-                      # If index verification fails, attempt to verify child platform manifests
-                      if [ "${VERIFIED_INDEX}" != "true" ] || [ "${VERIFIED_INDEX_KEYLESS}" != "true" ]; then
-                        echo "Index verification not available; attempting child manifest verification for ${BASE_IMAGE}:${IMAGE_TAG}"
-                        CHILD_VERIFIED=false
-
-                        for ARCH in arm64 amd64; do
-                          CHILD_TAG="${IMAGE_TAG}-${ARCH}"
-                          echo "Resolving child digest for ${BASE_IMAGE}:${CHILD_TAG}"
-                          CHILD_DIGEST="$(skopeo inspect --retry-times 3 docker://${BASE_IMAGE}:${CHILD_TAG} | jq -r '.Digest' || true)"
-                          if [ -n "${CHILD_DIGEST}" ] && [ "${CHILD_DIGEST}" != "null" ]; then
-                            CHILD_REF="${BASE_IMAGE}@${CHILD_DIGEST}"
-                            echo "==> cosign verify (public key) child ${CHILD_REF}"
-                            if retry_verify "cosign verify --key env://COSIGN_PUBLIC_KEY '${CHILD_REF}' -o text"; then
-                              CHILD_VERIFIED=true
-                              echo "Public key verification succeeded for child ${CHILD_REF}"
-                            else
-                              echo "Public key verification failed for child ${CHILD_REF}"
-                            fi
-
-                            echo "==> cosign verify (keyless policy) child ${CHILD_REF}"
-                            if retry_verify "cosign verify --certificate-oidc-issuer '${issuer}' --certificate-identity-regexp '${id_regex}' '${CHILD_REF}' -o text"; then
-                              CHILD_VERIFIED=true
-                              echo "Keyless verification succeeded for child ${CHILD_REF}"
-                            else
-                              echo "Keyless verification failed for child ${CHILD_REF}"
-                            fi
-                          else
-                            echo "No child digest found for ${BASE_IMAGE}:${CHILD_TAG}; skipping"
-                          fi
-                        done
-
-                        if [ "${CHILD_VERIFIED}" != "true" ]; then
-                          echo "Failed to verify index and no child manifests verified for ${BASE_IMAGE}:${IMAGE_TAG}"
-                          exit 10
-                        fi
-                      fi
+                      retry_verify "cosign verify --certificate-oidc-issuer '${issuer}' --certificate-identity-regexp '${id_regex}' '${REF}' -o text"

                      echo "✓ Successfully signed and verified ${BASE_IMAGE}:${IMAGE_TAG}"
                    done
--- a/messages/de-DE.json
+++ b/messages/de-DE.json
@@ -97,7 +97,7 @@
    "siteGeneralDescription": "Allgemeine Einstellungen für diesen Standort konfigurieren",
    "siteSettingDescription": "Standorteinstellungen konfigurieren",
    "siteSetting": "{siteName} Einstellungen",
-    "siteNewtTunnel": "Newt Standort (empfohlen)",
+    "siteNewtTunnel": "Neuer Standort (empfohlen)",
    "siteNewtTunnelDescription": "Einfachster Weg, einen Einstiegspunkt in jedes Netzwerk zu erstellen. Keine zusätzliche Einrichtung.",
    "siteWg": "Einfacher WireGuard Tunnel",
    "siteWgDescription": "Verwende jeden WireGuard-Client, um einen Tunnel einzurichten. Manuelles NAT-Setup erforderlich.",
@@ -107,7 +107,7 @@
    "siteSeeAll": "Alle Standorte anzeigen",
    "siteTunnelDescription": "Legen Sie fest, wie Sie sich mit dem Standort verbinden möchten",
    "siteNewtCredentials": "Zugangsdaten",
-    "siteNewtCredentialsDescription": "So wird sich der Standort mit dem Server authentifizieren",
+    "siteNewtCredentialsDescription": "So wird sich die Seite mit dem Server authentifizieren",
    "remoteNodeCredentialsDescription": "So wird sich der entfernte Node mit dem Server authentifizieren",
    "siteCredentialsSave": "Anmeldedaten speichern",
    "siteCredentialsSaveDescription": "Du kannst das nur einmal sehen. Stelle sicher, dass du es an einen sicheren Ort kopierst.",
@@ -2503,7 +2503,7 @@
    "deviceModel": "Gerätemodell",
    "serialNumber": "Seriennummer",
    "hostname": "Hostname",
-    "firstSeen": "Zuerst gesehen",
+    "firstSeen": "Erster Blick",
    "lastSeen": "Zuletzt gesehen",
    "biometricsEnabled": "Biometrie aktiviert",
    "diskEncrypted": "Festplatte verschlüsselt",
--- a/package-lock.json
+++ b/package-lock.json
@@ -82,7 +82,7 @@
                "node-cache": "5.1.2",
                "node-fetch": "3.3.2",
                "nodemailer": "7.0.11",
-                "npm": "11.7.0",
+                "npm": "11.8.0",
                "nprogress": "0.2.0",
                "oslo": "1.2.1",
                "pg": "8.17.1",
@@ -13944,7 +13944,6 @@
            "resolved": "https://registry.npmjs.org/eslint-plugin-import/-/eslint-plugin-import-2.32.0.tgz",
            "integrity": "sha512-whOE1HFo/qJDyX4SnXzP4N6zOWn79WhnCUY/iDR0mPfQZO8wcYE4JClzI2oZrhBnnMUCBCHZhO6VQyoBU95mZA==",
            "license": "MIT",
-            "peer": true,
            "dependencies": {
                "@rtsao/scc": "^1.1.0",
                "array-includes": "^3.1.9",
@@ -17048,9 +17047,9 @@
            }
        },
        "node_modules/npm": {
-            "version": "11.7.0",
-            "resolved": "https://registry.npmjs.org/npm/-/npm-11.7.0.tgz",
-            "integrity": "sha512-wiCZpv/41bIobCoJ31NStIWKfAxxYyD1iYnWCtiyns8s5v3+l8y0HCP/sScuH6B5+GhIfda4HQKiqeGZwJWhFw==",
+            "version": "11.8.0",
+            "resolved": "https://registry.npmjs.org/npm/-/npm-11.8.0.tgz",
+            "integrity": "sha512-n19sJeW+RGKdkHo8SCc5xhSwkKhQUFfZaFzSc+EsYXLjSqIV0tl72aDYQVuzVvfrbysGwdaQsNLNy58J10EBSQ==",
            "bundleDependencies": [
                "@isaacs/string-locale-compare",
                "@npmcli/arborist",
@@ -17129,8 +17128,8 @@
            ],
            "dependencies": {
                "@isaacs/string-locale-compare": "^1.1.0",
-                "@npmcli/arborist": "^9.1.9",
-                "@npmcli/config": "^10.4.5",
+                "@npmcli/arborist": "^9.1.10",
+                "@npmcli/config": "^10.5.0",
                "@npmcli/fs": "^5.0.0",
                "@npmcli/map-workspaces": "^5.0.3",
                "@npmcli/metavuln-calculator": "^9.0.3",
@@ -17138,7 +17137,7 @@
                "@npmcli/promise-spawn": "^9.0.1",
                "@npmcli/redact": "^4.0.0",
                "@npmcli/run-script": "^10.0.3",
-                "@sigstore/tuf": "^4.0.0",
+                "@sigstore/tuf": "^4.0.1",
                "abbrev": "^4.0.0",
                "archy": "~1.0.0",
                "cacache": "^20.0.3",
@@ -17155,11 +17154,11 @@
                "is-cidr": "^6.0.1",
                "json-parse-even-better-errors": "^5.0.0",
                "libnpmaccess": "^10.0.3",
-                "libnpmdiff": "^8.0.12",
-                "libnpmexec": "^10.1.11",
-                "libnpmfund": "^7.0.12",
+                "libnpmdiff": "^8.0.13",
+                "libnpmexec": "^10.1.12",
+                "libnpmfund": "^7.0.13",
                "libnpmorg": "^8.0.1",
-                "libnpmpack": "^9.0.12",
+                "libnpmpack": "^9.0.13",
                "libnpmpublish": "^11.1.3",
                "libnpmsearch": "^9.0.1",
                "libnpmteam": "^8.0.2",
@@ -17188,11 +17187,11 @@
                "spdx-expression-parse": "^4.0.0",
                "ssri": "^13.0.0",
                "supports-color": "^10.2.2",
-                "tar": "^7.5.2",
+                "tar": "^7.5.4",
                "text-table": "~0.2.0",
                "tiny-relative-date": "^2.0.2",
                "treeverse": "^3.0.0",
-                "validate-npm-package-name": "^7.0.0",
+                "validate-npm-package-name": "^7.0.2",
                "which": "^6.0.0"
            },
            "bin": {
@@ -17267,7 +17266,7 @@
            }
        },
        "node_modules/npm/node_modules/@npmcli/arborist": {
-            "version": "9.1.9",
+            "version": "9.1.10",
            "inBundle": true,
            "license": "ISC",
            "dependencies": {
@@ -17284,7 +17283,7 @@
                "@npmcli/run-script": "^10.0.0",
                "bin-links": "^6.0.0",
                "cacache": "^20.0.1",
-                "common-ancestor-path": "^1.0.1",
+                "common-ancestor-path": "^2.0.0",
                "hosted-git-info": "^9.0.0",
                "json-stringify-nice": "^1.1.4",
                "lru-cache": "^11.2.1",
@@ -17313,7 +17312,7 @@
            }
        },
        "node_modules/npm/node_modules/@npmcli/config": {
-            "version": "10.4.5",
+            "version": "10.5.0",
            "inBundle": true,
            "license": "ISC",
            "dependencies": {
@@ -17494,7 +17493,7 @@
            }
        },
        "node_modules/npm/node_modules/@sigstore/core": {
-            "version": "3.0.0",
+            "version": "3.1.0",
            "inBundle": true,
            "license": "Apache-2.0",
            "engines": {
@@ -17510,48 +17509,40 @@
            }
        },
        "node_modules/npm/node_modules/@sigstore/sign": {
-            "version": "4.0.1",
+            "version": "4.1.0",
            "inBundle": true,
            "license": "Apache-2.0",
            "dependencies": {
                "@sigstore/bundle": "^4.0.0",
-                "@sigstore/core": "^3.0.0",
+                "@sigstore/core": "^3.1.0",
                "@sigstore/protobuf-specs": "^0.5.0",
-                "make-fetch-happen": "^15.0.2",
-                "proc-log": "^5.0.0",
+                "make-fetch-happen": "^15.0.3",
+                "proc-log": "^6.1.0",
                "promise-retry": "^2.0.1"
            },
            "engines": {
                "node": "^20.17.0 || >=22.9.0"
            }
        },
-        "node_modules/npm/node_modules/@sigstore/sign/node_modules/proc-log": {
-            "version": "5.0.0",
-            "inBundle": true,
-            "license": "ISC",
-            "engines": {
-                "node": "^18.17.0 || >=20.5.0"
-            }
-        },
        "node_modules/npm/node_modules/@sigstore/tuf": {
-            "version": "4.0.0",
+            "version": "4.0.1",
            "inBundle": true,
            "license": "Apache-2.0",
            "dependencies": {
                "@sigstore/protobuf-specs": "^0.5.0",
-                "tuf-js": "^4.0.0"
+                "tuf-js": "^4.1.0"
            },
            "engines": {
                "node": "^20.17.0 || >=22.9.0"
            }
        },
        "node_modules/npm/node_modules/@sigstore/verify": {
-            "version": "3.0.0",
+            "version": "3.1.0",
            "inBundle": true,
            "license": "Apache-2.0",
            "dependencies": {
                "@sigstore/bundle": "^4.0.0",
-                "@sigstore/core": "^3.0.0",
+                "@sigstore/core": "^3.1.0",
                "@sigstore/protobuf-specs": "^0.5.0"
            },
            "engines": {
@@ -17567,31 +17558,17 @@
            }
        },
        "node_modules/npm/node_modules/@tufjs/models": {
-            "version": "4.0.0",
+            "version": "4.1.0",
            "inBundle": true,
            "license": "MIT",
            "dependencies": {
                "@tufjs/canonical-json": "2.0.0",
-                "minimatch": "^9.0.5"
+                "minimatch": "^10.1.1"
            },
            "engines": {
                "node": "^20.17.0 || >=22.9.0"
            }
        },
-        "node_modules/npm/node_modules/@tufjs/models/node_modules/minimatch": {
-            "version": "9.0.5",
-            "inBundle": true,
-            "license": "ISC",
-            "dependencies": {
-                "brace-expansion": "^2.0.1"
-            },
-            "engines": {
-                "node": ">=16 || 14 >=14.17"
-            },
-            "funding": {
-                "url": "https://github.com/sponsors/isaacs"
-            }
-        },
        "node_modules/npm/node_modules/abbrev": {
            "version": "4.0.0",
            "inBundle": true,
@@ -17626,11 +17603,6 @@
            "inBundle": true,
            "license": "MIT"
        },
-        "node_modules/npm/node_modules/balanced-match": {
-            "version": "1.0.2",
-            "inBundle": true,
-            "license": "MIT"
-        },
        "node_modules/npm/node_modules/bin-links": {
            "version": "6.0.0",
            "inBundle": true,
@@ -17657,14 +17629,6 @@
                "url": "https://github.com/sponsors/sindresorhus"
            }
        },
-        "node_modules/npm/node_modules/brace-expansion": {
-            "version": "2.0.2",
-            "inBundle": true,
-            "license": "MIT",
-            "dependencies": {
-                "balanced-match": "^1.0.0"
-            }
-        },
        "node_modules/npm/node_modules/cacache": {
            "version": "20.0.3",
            "inBundle": true,
@@ -17751,9 +17715,12 @@
            }
        },
        "node_modules/npm/node_modules/common-ancestor-path": {
-            "version": "1.0.1",
+            "version": "2.0.0",
            "inBundle": true,
-            "license": "ISC"
+            "license": "BlueOak-1.0.0",
+            "engines": {
+                "node": ">= 18"
+            }
        },
        "node_modules/npm/node_modules/cssesc": {
            "version": "3.0.0",
@@ -17783,7 +17750,7 @@
            }
        },
        "node_modules/npm/node_modules/diff": {
-            "version": "8.0.2",
+            "version": "8.0.3",
            "inBundle": true,
            "license": "BSD-3-Clause",
            "engines": {
@@ -17959,7 +17926,7 @@
            }
        },
        "node_modules/npm/node_modules/ip-address": {
-            "version": "10.0.1",
+            "version": "10.1.0",
            "inBundle": true,
            "license": "MIT",
            "engines": {
@@ -18051,11 +18018,11 @@
            }
        },
        "node_modules/npm/node_modules/libnpmdiff": {
-            "version": "8.0.12",
+            "version": "8.0.13",
            "inBundle": true,
            "license": "ISC",
            "dependencies": {
-                "@npmcli/arborist": "^9.1.9",
+                "@npmcli/arborist": "^9.1.10",
                "@npmcli/installed-package-contents": "^4.0.0",
                "binary-extensions": "^3.0.0",
                "diff": "^8.0.2",
@@ -18069,11 +18036,11 @@
            }
        },
        "node_modules/npm/node_modules/libnpmexec": {
-            "version": "10.1.11",
+            "version": "10.1.12",
            "inBundle": true,
            "license": "ISC",
            "dependencies": {
-                "@npmcli/arborist": "^9.1.9",
+                "@npmcli/arborist": "^9.1.10",
                "@npmcli/package-json": "^7.0.0",
                "@npmcli/run-script": "^10.0.0",
                "ci-info": "^4.0.0",
@@ -18091,11 +18058,11 @@
            }
        },
        "node_modules/npm/node_modules/libnpmfund": {
-            "version": "7.0.12",
+            "version": "7.0.13",
            "inBundle": true,
            "license": "ISC",
            "dependencies": {
-                "@npmcli/arborist": "^9.1.9"
+                "@npmcli/arborist": "^9.1.10"
            },
            "engines": {
                "node": "^20.17.0 || >=22.9.0"
@@ -18114,11 +18081,11 @@
            }
        },
        "node_modules/npm/node_modules/libnpmpack": {
-            "version": "9.0.12",
+            "version": "9.0.13",
            "inBundle": true,
            "license": "ISC",
            "dependencies": {
-                "@npmcli/arborist": "^9.1.9",
+                "@npmcli/arborist": "^9.1.10",
                "@npmcli/run-script": "^10.0.0",
                "npm-package-arg": "^13.0.0",
                "pacote": "^21.0.2"
@@ -18184,9 +18151,9 @@
            }
        },
        "node_modules/npm/node_modules/lru-cache": {
-            "version": "11.2.2",
+            "version": "11.2.4",
            "inBundle": true,
-            "license": "ISC",
+            "license": "BlueOak-1.0.0",
            "engines": {
                "node": "20 || >=22"
            }
@@ -18567,7 +18534,7 @@
            }
        },
        "node_modules/npm/node_modules/path-scurry": {
-            "version": "2.0.0",
+            "version": "2.0.1",
            "inBundle": true,
            "license": "BlueOak-1.0.0",
            "dependencies": {
@@ -18582,7 +18549,7 @@
            }
        },
        "node_modules/npm/node_modules/postcss-selector-parser": {
-            "version": "7.1.0",
+            "version": "7.1.1",
            "inBundle": true,
            "license": "MIT",
            "dependencies": {
@@ -18711,16 +18678,16 @@
            }
        },
        "node_modules/npm/node_modules/sigstore": {
-            "version": "4.0.0",
+            "version": "4.1.0",
            "inBundle": true,
            "license": "Apache-2.0",
            "dependencies": {
                "@sigstore/bundle": "^4.0.0",
-                "@sigstore/core": "^3.0.0",
+                "@sigstore/core": "^3.1.0",
                "@sigstore/protobuf-specs": "^0.5.0",
-                "@sigstore/sign": "^4.0.0",
-                "@sigstore/tuf": "^4.0.0",
-                "@sigstore/verify": "^3.0.0"
+                "@sigstore/sign": "^4.1.0",
+                "@sigstore/tuf": "^4.0.1",
+                "@sigstore/verify": "^3.1.0"
            },
            "engines": {
                "node": "^20.17.0 || >=22.9.0"
@@ -18845,7 +18812,7 @@
            }
        },
        "node_modules/npm/node_modules/tar": {
-            "version": "7.5.2",
+            "version": "7.5.4",
            "inBundle": true,
            "license": "BlueOak-1.0.0",
            "dependencies": {
@@ -18928,13 +18895,13 @@
            }
        },
        "node_modules/npm/node_modules/tuf-js": {
-            "version": "4.0.0",
+            "version": "4.1.0",
            "inBundle": true,
            "license": "MIT",
            "dependencies": {
-                "@tufjs/models": "4.0.0",
-                "debug": "^4.4.1",
-                "make-fetch-happen": "^15.0.0"
+                "@tufjs/models": "4.1.0",
+                "debug": "^4.4.3",
+                "make-fetch-happen": "^15.0.1"
            },
            "engines": {
                "node": "^20.17.0 || >=22.9.0"
@@ -18986,7 +18953,7 @@
            }
        },
        "node_modules/npm/node_modules/validate-npm-package-name": {
-            "version": "7.0.0",
+            "version": "7.0.2",
            "inBundle": true,
            "license": "ISC",
            "engines": {
--- a/package.json
+++ b/package.json
@@ -106,7 +106,7 @@
        "node-cache": "5.1.2",
        "node-fetch": "3.3.2",
        "nodemailer": "7.0.11",
-        "npm": "11.7.0",
+        "npm": "11.8.0",
        "nprogress": "0.2.0",
        "oslo": "1.2.1",
        "pg": "8.17.1",
--- a/server/setup/ensureSetupToken.ts
+++ b/server/setup/ensureSetupToken.ts
@@ -64,20 +64,16 @@ export async function ensureSetupToken() {
                );
            }

-            if (existingToken) {
-                // Token exists in DB - update it if different
-                if (existingToken.token !== envSetupToken) {
-                    console.warn(
-                        "Overwriting existing token in DB since PANGOLIN_SETUP_TOKEN is set"
-                    );
+            if (existingToken?.token !== envSetupToken) {
+                console.warn(
+                    "Overwriting existing token in DB since PANGOLIN_SETUP_TOKEN is set"
+                );

-                    await db
-                        .update(setupTokens)
-                        .set({ token: envSetupToken })
-                        .where(eq(setupTokens.tokenId, existingToken.tokenId));
-                }
+                await db
+                    .update(setupTokens)
+                    .set({ token: envSetupToken })
+                    .where(eq(setupTokens.tokenId, existingToken.tokenId));
            } else {
-                // No existing token - insert new one
                const tokenId = generateId(15);

                await db.insert(setupTokens).values({