all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe8c:5a71
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 13d625d6-d4f0-467a-a241-b9f19e0cebbb
        host_id: 7f2607eceb24f4583c6f9496c53c64b51afe50de5eacda4379b21c42
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe8c:5a71
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.34
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.244
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe8c:5a71
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job flake8 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#32>'
      - '<Job flake8 explicit: None implied: None source: osism/python-osism/.zuul.yaml@main#143>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: d7033e5b9be24badb780e3b5b9918dd9
      build_refs:
      - branch: main
        change: '2505'
        change_message: "Update dependency next to v16.2.11 [SECURITY]\n\nThis PR
          contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [next](https://nextjs.org) ([source](https://redirect.github.com/vercel/next.js))
          | [`16.2.10` \u2192 `16.2.11`](https://renovatebot.com/diffs/npm/next/16.2.10/16.2.11)
          | ![age](https://developer.mend.io/api/mc/badges/age/npm/next/16.2.11?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/next/16.2.10/16.2.11?slim=true)
          |\n\n---\n\n### Next.js: Cache confusion of response bodies for requests
          with bodies containing invalid UTF-8 byte sequences\n[CVE-2026-64647](https://nvd.nist.gov/vuln/detail/CVE-2026-64647)
          / [GHSA-4633-3j49-mh5q](https://redirect.github.com/advisories/GHSA-4633-3j49-mh5q)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nA server-side `fetch`
          with a request body may return a cached **response** body from a different
          request to the same URL but different body. Confidential data in the `POST`'s
          **response** body would then leak to unauthorized requests. Though the request
          itself will not be deduped.\n\nThis is only an issue when receiving request
          bodies with a content type charset other than UTF-8. For example, the UTF-16
          byte sequences for `\uC083\uC083` and `\uC104\uC104` in the request body
          would share the same cache.\n\n##### Workarounds\n\nIf you cannot upgrade,
          consider only making fetch requests with UTF-8 bodies (default in Next.js).
          Applications using Pages Router are not vulnerable.\n\n#### Severity\n-
          CVSS Score: 6.3 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q)\n-
          [https://github.com/vercel/next.js/pull/96008](https://redirect.github.com/vercel/next.js/pull/96008)\n-
          [https://github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082](https://redirect.github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-4633-3j49-mh5q)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Unbounded Server Action payload in Edge runtime\n[CVE-2026-64646](https://nvd.nist.gov/vuln/detail/CVE-2026-64646)
          / [GHSA-4c39-4ccg-62r3](https://redirect.github.com/advisories/GHSA-4c39-4ccg-62r3)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nRequests targeting
          Next.js applications using App Router with at least one Server Action can
          lead to excessive memory consumption if that Server Actions uses the Edge
          runtime\n\n##### Workarounds\n\nIf you cannot upgrade, ensure your hosting
          provider limits the request's body size. 5 MiB should be allowed at max
          by your hosting provider.\n\n#### Severity\n- CVSS Score: 6.3 / 10 (Medium)\n-
          Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3)\n-
          [https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4](https://redirect.github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4)\n-
          [https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17](https://redirect.github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Cache confusion of response bodies for requests with bodies\n[CVE-2026-64648](https://nvd.nist.gov/vuln/detail/CVE-2026-64648)
          / [GHSA-68g3-v927-f742](https://redirect.github.com/advisories/GHSA-68g3-v927-f742)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nA server-side `fetch`
          with a request body may return a cached **response** body from a different
          request to the same URL but different body. Confidential data in the `POST`'s
          **response** body would then leak to unauthorized requests. Though the request
          itself will not be deduped.\n\nThis only applies to `fetch` calls with a
          request that has a different init than the one passed to `fetch`.\nSafe:
          `fetch(new Request(init), init)`\nUnsafe: `fetch(new Request(init), aDifferentInit)`\n\n#####
          Workarounds\n\nNo workaround exists besides upgrading. Applications using
          Pages Router are not vulnerable.\n\n#### Severity\n- CVSS Score: 6.0 / 10
          (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742)\n-
          [https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c](https://redirect.github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c)\n-
          [https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a](https://redirect.github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-68g3-v927-f742)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Middleware / Proxy bypass in App Router applications using Turbopack
          and single locale\n[CVE-2026-64642](https://nvd.nist.gov/vuln/detail/CVE-2026-64642)
          / [GHSA-6gpp-xcg3-4w24](https://redirect.github.com/advisories/GHSA-6gpp-xcg3-4w24)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nCrafted requests
          targeting Next.js applications using App Router built with Turbopack and
          a **single** entry in `config.i18n.locales` can bypass middleware/proxy
          based authentication.\n\n##### Workarounds\n\nIf you cannot upgrade immediately,
          enforce authorization in the page's server-side data path instead of relying
          solely on middleware.\n\n#### Severity\n- CVSS Score: 8.3 / 10 (High)\n-
          Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24)\n-
          [https://github.com/vercel/next.js/pull/96014](https://redirect.github.com/vercel/next.js/pull/96014)\n-
          [https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151](https://redirect.github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6gpp-xcg3-4w24)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Server-Side Request Forgery in Server Actions on custom servers\n[CVE-2026-64649](https://nvd.nist.gov/vuln/detail/CVE-2026-64649)
          / [GHSA-89xv-2m56-2m9x](https://redirect.github.com/advisories/GHSA-89xv-2m56-2m9x)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nWhen a Server Action
          forwards or redirects a request, an attacker can cause the server to send
          that outbound request to a malicious host (Server-Side Request Forgery).
          This requires the attacker's request to control Host-associated headers.
          In some configurations, it's also possible to obtain internal values that
          weaken middleware/proxy authorization.\n\nApplications that use Server Actions
          are affected when the incoming host header is not fixed to a trusted value.
          This typically occurs on custom servers, or on deployments not behind a
          proxy that pins the host. Managed hosting pins the host upstream and is
          not affected; `next start` and standalone output do the same from version
          14.2 onward.\n\n##### Workarounds\n\nIf you cannot upgrade, ensure clients
          do not control the host header your application receives. Pin or validate
          `Host` and `X-Forwarded-Host` at your edge or proxy. On version 14.2.0 and
          later, you can additionally set the `__NEXT_PRIVATE_ORIGIN` environment
          variable to your deployment's real origin:\n\n```bash\n__NEXT_PRIVATE_ORIGIN=https://www.example.com
          node server.js\n\n#### Severity\n- CVSS Score: 8.3 / 10 (High)\n- Vector
          String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x)\n-
          [https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b](https://redirect.github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b)\n-
          [https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498](https://redirect.github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Unauthenticated disclosure of internal Server Function endpoints\n[CVE-2026-64643](https://nvd.nist.gov/vuln/detail/CVE-2026-64643)
          / [GHSA-955p-x3mx-jcvp](https://redirect.github.com/advisories/GHSA-955p-x3mx-jcvp)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nIn Next.js applications
          using App Router, Server Actions (`use server`) or `use cache` endpoints
          can be disclosed bypassing any authentication on the pages where these endpoints
          are usually used.\n\nServer Action IDs can be disclosed to unauthenticated
          users via publicly served client artifacts (for example, static chunks containing
          action references).\n\nAffected users are applications using App Router
          + Server Actions.  \n\nBy itself, this disclosure is typically a recon/enumeration
          primitive; however, it can increase risk when combined with other weaknesses.\n
          \n\n##### Workarounds\n\nNever assume any authentication claims at the `use
          cache` or `use server` boundary. Always authenticate within the boundary.\n\n####
          Severity\n- CVSS Score: 6.3 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp)\n-
          [https://github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3](https://redirect.github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3)\n-
          [https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b](https://redirect.github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-955p-x3mx-jcvp)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Denial of Service in App Router using Server Actions\n[CVE-2026-64641](https://nvd.nist.gov/vuln/detail/CVE-2026-64641)
          / [GHSA-m99w-x7hq-7vfj](https://redirect.github.com/advisories/GHSA-m99w-x7hq-7vfj)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nCrafted requests
          targeting Next.js applications using App Router with at least one Server
          Action can lead to excessive CPU usage blocking processing of further requests
          in the same process.\n\n##### Workarounds\n\nNo workaround exists besides
          upgrading. Applications using Pages Router or not using Server Actions are
          not vulnerable.\n\n#### Severity\n- CVSS Score: 8.2 / 10 (High)\n- Vector
          String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj)\n-
          [https://github.com/vercel/next.js/pull/96013](https://redirect.github.com/vercel/next.js/pull/96013)\n-
          [https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12](https://redirect.github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Server-Side Request Forgery in rewrites via attacker-controlled
          destination hostname\n[CVE-2026-64645](https://nvd.nist.gov/vuln/detail/CVE-2026-64645)
          / [GHSA-p9j2-gv94-2wf4](https://redirect.github.com/advisories/GHSA-p9j2-gv94-2wf4)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nA `rewrites()` or
          `redirects()` rule that builds its external destination hostname from request-controlled
          input can be pointed at an arbitrary hostname, regardless of the rule's\_hostname
          suffix. For a rewrite, Next.js proxies the request to that arbitrary host
          and serves the response from the application's origin, leading to Server-Side
          Request forgery. A `redirects()` rule configured this way is vulnerable
          to an Open Redirect.\n\nThis affects any destination that puts a dynamic
          segment in the hostname, whether from the path:\n\n```javascript\n// next.config.js\nmodule.exports
          = {\n  async rewrites() {\n    return [\n      {\n        source: '/:tenant',\n
          \       destination: 'https://:tenant.api.example.com',\n      },\n    ]\n
          \ },\n}\n```\n\nor from a `has` capture:\n\n```javascript\n// next.config.js\nmodule.exports
          = {\n  async rewrites() {\n    return [\n      {\n        source: '/',\n
          \       has: [{ type: 'query', key: 'region', value: '(?<region>.+)' }],\n
          \       destination: 'https://:region.api.example.com',\n      },\n    ]\n
          \ },\n}\n```\n\n##### Workarounds\n\nIf you cannot upgrade immediately,
          do not build the hostname of an external `rewrites()` or `redirects()` destination
          from user-controlled input. If a dynamic subdomain is required, constrain
          the value to hostname-safe characters:  `value: '(?<region>[a-z0-9-]+)'`.\n\n####
          Severity\n- CVSS Score: 8.3 / 10 (High)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4)\n-
          [https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9](https://redirect.github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9)\n-
          [https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599](https://redirect.github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Denial of Service in the Image Optimization API using SVGs\n[CVE-2026-64644](https://nvd.nist.gov/vuln/detail/CVE-2026-64644)
          / [GHSA-q8wf-6r8g-63ch](https://redirect.github.com/advisories/GHSA-q8wf-6r8g-63ch)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nWhen self-hosting
          Next.js with the default image loader, the Image Optimization API can optimize
          remotely hosted images if configured (not enabled by default). If those
          images contain malicious content, they can cause CPU exhaustion in  `/_next/image`
          endpoints.\n\n- If you are using `config.images.remotePatterns`, only the
          patterns in that array are impacted.\n- If you are using `config.images.unoptimized:
          true`, you are NOT impacted.\n- If you are using `config.images.loader:
          'custom'`, you are NOT impacted.\n- If you are using Vercel, you are NOT
          impacted.\n\n##### Workarounds\n\nIf you cannot upgrade immediately, you
          can avoid the expensive work by setting `config.experimental.imgOptSkipMetadata
          : true`.\n\n#### Severity\n- CVSS Score: 6.3 / 10 (Medium)\n- Vector String:
          `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch)\n-
          [https://github.com/vercel/next.js/pull/96006](https://redirect.github.com/vercel/next.js/pull/96006)\n-
          [https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c](https://redirect.github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-q8wf-6r8g-63ch)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Release Notes\n\n<details>\n<summary>vercel/next.js (next)</summary>\n\n###
          [`v16.2.11`](https://redirect.github.com/vercel/next.js/compare/v16.2.10...v16.2.11)\n\n[Compare
          Source](https://redirect.github.com/vercel/next.js/compare/v16.2.10...v16.2.11)\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
          manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
          conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
          Close this PR and you won't be reminded about this update again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/python-osism).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzUuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI3NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/python-osism/pull/2505
        commit_id: 198f264c96655fe2c1029802caad50251383d36f
        patchset: 198f264c96655fe2c1029802caad50251383d36f
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          name: osism/python-osism
          short_name: python-osism
        src_dir: src/github.com/osism/python-osism
        topic: null
      buildset: 8496bf26287a4aacbea19752e70c335c
      buildset_refs:
      - branch: main
        change: '2505'
        change_message: "Update dependency next to v16.2.11 [SECURITY]\n\nThis PR
          contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [next](https://nextjs.org) ([source](https://redirect.github.com/vercel/next.js))
          | [`16.2.10` \u2192 `16.2.11`](https://renovatebot.com/diffs/npm/next/16.2.10/16.2.11)
          | ![age](https://developer.mend.io/api/mc/badges/age/npm/next/16.2.11?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/next/16.2.10/16.2.11?slim=true)
          |\n\n---\n\n### Next.js: Cache confusion of response bodies for requests
          with bodies containing invalid UTF-8 byte sequences\n[CVE-2026-64647](https://nvd.nist.gov/vuln/detail/CVE-2026-64647)
          / [GHSA-4633-3j49-mh5q](https://redirect.github.com/advisories/GHSA-4633-3j49-mh5q)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nA server-side `fetch`
          with a request body may return a cached **response** body from a different
          request to the same URL but different body. Confidential data in the `POST`'s
          **response** body would then leak to unauthorized requests. Though the request
          itself will not be deduped.\n\nThis is only an issue when receiving request
          bodies with a content type charset other than UTF-8. For example, the UTF-16
          byte sequences for `\uC083\uC083` and `\uC104\uC104` in the request body
          would share the same cache.\n\n##### Workarounds\n\nIf you cannot upgrade,
          consider only making fetch requests with UTF-8 bodies (default in Next.js).
          Applications using Pages Router are not vulnerable.\n\n#### Severity\n-
          CVSS Score: 6.3 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q)\n-
          [https://github.com/vercel/next.js/pull/96008](https://redirect.github.com/vercel/next.js/pull/96008)\n-
          [https://github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082](https://redirect.github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-4633-3j49-mh5q)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Unbounded Server Action payload in Edge runtime\n[CVE-2026-64646](https://nvd.nist.gov/vuln/detail/CVE-2026-64646)
          / [GHSA-4c39-4ccg-62r3](https://redirect.github.com/advisories/GHSA-4c39-4ccg-62r3)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nRequests targeting
          Next.js applications using App Router with at least one Server Action can
          lead to excessive memory consumption if that Server Actions uses the Edge
          runtime\n\n##### Workarounds\n\nIf you cannot upgrade, ensure your hosting
          provider limits the request's body size. 5 MiB should be allowed at max
          by your hosting provider.\n\n#### Severity\n- CVSS Score: 6.3 / 10 (Medium)\n-
          Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3)\n-
          [https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4](https://redirect.github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4)\n-
          [https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17](https://redirect.github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Cache confusion of response bodies for requests with bodies\n[CVE-2026-64648](https://nvd.nist.gov/vuln/detail/CVE-2026-64648)
          / [GHSA-68g3-v927-f742](https://redirect.github.com/advisories/GHSA-68g3-v927-f742)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nA server-side `fetch`
          with a request body may return a cached **response** body from a different
          request to the same URL but different body. Confidential data in the `POST`'s
          **response** body would then leak to unauthorized requests. Though the request
          itself will not be deduped.\n\nThis only applies to `fetch` calls with a
          request that has a different init than the one passed to `fetch`.\nSafe:
          `fetch(new Request(init), init)`\nUnsafe: `fetch(new Request(init), aDifferentInit)`\n\n#####
          Workarounds\n\nNo workaround exists besides upgrading. Applications using
          Pages Router are not vulnerable.\n\n#### Severity\n- CVSS Score: 6.0 / 10
          (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742)\n-
          [https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c](https://redirect.github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c)\n-
          [https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a](https://redirect.github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-68g3-v927-f742)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Middleware / Proxy bypass in App Router applications using Turbopack
          and single locale\n[CVE-2026-64642](https://nvd.nist.gov/vuln/detail/CVE-2026-64642)
          / [GHSA-6gpp-xcg3-4w24](https://redirect.github.com/advisories/GHSA-6gpp-xcg3-4w24)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nCrafted requests
          targeting Next.js applications using App Router built with Turbopack and
          a **single** entry in `config.i18n.locales` can bypass middleware/proxy
          based authentication.\n\n##### Workarounds\n\nIf you cannot upgrade immediately,
          enforce authorization in the page's server-side data path instead of relying
          solely on middleware.\n\n#### Severity\n- CVSS Score: 8.3 / 10 (High)\n-
          Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24)\n-
          [https://github.com/vercel/next.js/pull/96014](https://redirect.github.com/vercel/next.js/pull/96014)\n-
          [https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151](https://redirect.github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6gpp-xcg3-4w24)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Server-Side Request Forgery in Server Actions on custom servers\n[CVE-2026-64649](https://nvd.nist.gov/vuln/detail/CVE-2026-64649)
          / [GHSA-89xv-2m56-2m9x](https://redirect.github.com/advisories/GHSA-89xv-2m56-2m9x)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nWhen a Server Action
          forwards or redirects a request, an attacker can cause the server to send
          that outbound request to a malicious host (Server-Side Request Forgery).
          This requires the attacker's request to control Host-associated headers.
          In some configurations, it's also possible to obtain internal values that
          weaken middleware/proxy authorization.\n\nApplications that use Server Actions
          are affected when the incoming host header is not fixed to a trusted value.
          This typically occurs on custom servers, or on deployments not behind a
          proxy that pins the host. Managed hosting pins the host upstream and is
          not affected; `next start` and standalone output do the same from version
          14.2 onward.\n\n##### Workarounds\n\nIf you cannot upgrade, ensure clients
          do not control the host header your application receives. Pin or validate
          `Host` and `X-Forwarded-Host` at your edge or proxy. On version 14.2.0 and
          later, you can additionally set the `__NEXT_PRIVATE_ORIGIN` environment
          variable to your deployment's real origin:\n\n```bash\n__NEXT_PRIVATE_ORIGIN=https://www.example.com
          node server.js\n\n#### Severity\n- CVSS Score: 8.3 / 10 (High)\n- Vector
          String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x)\n-
          [https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b](https://redirect.github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b)\n-
          [https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498](https://redirect.github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Unauthenticated disclosure of internal Server Function endpoints\n[CVE-2026-64643](https://nvd.nist.gov/vuln/detail/CVE-2026-64643)
          / [GHSA-955p-x3mx-jcvp](https://redirect.github.com/advisories/GHSA-955p-x3mx-jcvp)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nIn Next.js applications
          using App Router, Server Actions (`use server`) or `use cache` endpoints
          can be disclosed bypassing any authentication on the pages where these endpoints
          are usually used.\n\nServer Action IDs can be disclosed to unauthenticated
          users via publicly served client artifacts (for example, static chunks containing
          action references).\n\nAffected users are applications using App Router
          + Server Actions.  \n\nBy itself, this disclosure is typically a recon/enumeration
          primitive; however, it can increase risk when combined with other weaknesses.\n
          \n\n##### Workarounds\n\nNever assume any authentication claims at the `use
          cache` or `use server` boundary. Always authenticate within the boundary.\n\n####
          Severity\n- CVSS Score: 6.3 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp)\n-
          [https://github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3](https://redirect.github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3)\n-
          [https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b](https://redirect.github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-955p-x3mx-jcvp)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Denial of Service in App Router using Server Actions\n[CVE-2026-64641](https://nvd.nist.gov/vuln/detail/CVE-2026-64641)
          / [GHSA-m99w-x7hq-7vfj](https://redirect.github.com/advisories/GHSA-m99w-x7hq-7vfj)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nCrafted requests
          targeting Next.js applications using App Router with at least one Server
          Action can lead to excessive CPU usage blocking processing of further requests
          in the same process.\n\n##### Workarounds\n\nNo workaround exists besides
          upgrading. Applications using Pages Router or not using Server Actions are
          not vulnerable.\n\n#### Severity\n- CVSS Score: 8.2 / 10 (High)\n- Vector
          String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj)\n-
          [https://github.com/vercel/next.js/pull/96013](https://redirect.github.com/vercel/next.js/pull/96013)\n-
          [https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12](https://redirect.github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Server-Side Request Forgery in rewrites via attacker-controlled
          destination hostname\n[CVE-2026-64645](https://nvd.nist.gov/vuln/detail/CVE-2026-64645)
          / [GHSA-p9j2-gv94-2wf4](https://redirect.github.com/advisories/GHSA-p9j2-gv94-2wf4)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nA `rewrites()` or
          `redirects()` rule that builds its external destination hostname from request-controlled
          input can be pointed at an arbitrary hostname, regardless of the rule's\_hostname
          suffix. For a rewrite, Next.js proxies the request to that arbitrary host
          and serves the response from the application's origin, leading to Server-Side
          Request forgery. A `redirects()` rule configured this way is vulnerable
          to an Open Redirect.\n\nThis affects any destination that puts a dynamic
          segment in the hostname, whether from the path:\n\n```javascript\n// next.config.js\nmodule.exports
          = {\n  async rewrites() {\n    return [\n      {\n        source: '/:tenant',\n
          \       destination: 'https://:tenant.api.example.com',\n      },\n    ]\n
          \ },\n}\n```\n\nor from a `has` capture:\n\n```javascript\n// next.config.js\nmodule.exports
          = {\n  async rewrites() {\n    return [\n      {\n        source: '/',\n
          \       has: [{ type: 'query', key: 'region', value: '(?<region>.+)' }],\n
          \       destination: 'https://:region.api.example.com',\n      },\n    ]\n
          \ },\n}\n```\n\n##### Workarounds\n\nIf you cannot upgrade immediately,
          do not build the hostname of an external `rewrites()` or `redirects()` destination
          from user-controlled input. If a dynamic subdomain is required, constrain
          the value to hostname-safe characters:  `value: '(?<region>[a-z0-9-]+)'`.\n\n####
          Severity\n- CVSS Score: 8.3 / 10 (High)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4)\n-
          [https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9](https://redirect.github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9)\n-
          [https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599](https://redirect.github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Denial of Service in the Image Optimization API using SVGs\n[CVE-2026-64644](https://nvd.nist.gov/vuln/detail/CVE-2026-64644)
          / [GHSA-q8wf-6r8g-63ch](https://redirect.github.com/advisories/GHSA-q8wf-6r8g-63ch)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nWhen self-hosting
          Next.js with the default image loader, the Image Optimization API can optimize
          remotely hosted images if configured (not enabled by default). If those
          images contain malicious content, they can cause CPU exhaustion in  `/_next/image`
          endpoints.\n\n- If you are using `config.images.remotePatterns`, only the
          patterns in that array are impacted.\n- If you are using `config.images.unoptimized:
          true`, you are NOT impacted.\n- If you are using `config.images.loader:
          'custom'`, you are NOT impacted.\n- If you are using Vercel, you are NOT
          impacted.\n\n##### Workarounds\n\nIf you cannot upgrade immediately, you
          can avoid the expensive work by setting `config.experimental.imgOptSkipMetadata
          : true`.\n\n#### Severity\n- CVSS Score: 6.3 / 10 (Medium)\n- Vector String:
          `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch)\n-
          [https://github.com/vercel/next.js/pull/96006](https://redirect.github.com/vercel/next.js/pull/96006)\n-
          [https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c](https://redirect.github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-q8wf-6r8g-63ch)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Release Notes\n\n<details>\n<summary>vercel/next.js (next)</summary>\n\n###
          [`v16.2.11`](https://redirect.github.com/vercel/next.js/compare/v16.2.10...v16.2.11)\n\n[Compare
          Source](https://redirect.github.com/vercel/next.js/compare/v16.2.10...v16.2.11)\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
          manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
          conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
          Close this PR and you won't be reminded about this update again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/python-osism).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzUuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI3NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/python-osism/pull/2505
        commit_id: 198f264c96655fe2c1029802caad50251383d36f
        patchset: 198f264c96655fe2c1029802caad50251383d36f
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          name: osism/python-osism
          short_name: python-osism
        src_dir: src/github.com/osism/python-osism
        topic: null
      change: '2505'
      change_message: "Update dependency next to v16.2.11 [SECURITY]\n\nThis PR contains
        the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
        | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
        [next](https://nextjs.org) ([source](https://redirect.github.com/vercel/next.js))
        | [`16.2.10` \u2192 `16.2.11`](https://renovatebot.com/diffs/npm/next/16.2.10/16.2.11)
        | ![age](https://developer.mend.io/api/mc/badges/age/npm/next/16.2.11?slim=true)
        | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/next/16.2.10/16.2.11?slim=true)
        |\n\n---\n\n### Next.js: Cache confusion of response bodies for requests with
        bodies containing invalid UTF-8 byte sequences\n[CVE-2026-64647](https://nvd.nist.gov/vuln/detail/CVE-2026-64647)
        / [GHSA-4633-3j49-mh5q](https://redirect.github.com/advisories/GHSA-4633-3j49-mh5q)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Impact\n\nA server-side `fetch`
        with a request body may return a cached **response** body from a different
        request to the same URL but different body. Confidential data in the `POST`'s
        **response** body would then leak to unauthorized requests. Though the request
        itself will not be deduped.\n\nThis is only an issue when receiving request
        bodies with a content type charset other than UTF-8. For example, the UTF-16
        byte sequences for `\uC083\uC083` and `\uC104\uC104` in the request body would
        share the same cache.\n\n##### Workarounds\n\nIf you cannot upgrade, consider
        only making fetch requests with UTF-8 bodies (default in Next.js). Applications
        using Pages Router are not vulnerable.\n\n#### Severity\n- CVSS Score: 6.3
        / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N`\n\n####
        References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q)\n-
        [https://github.com/vercel/next.js/pull/96008](https://redirect.github.com/vercel/next.js/pull/96008)\n-
        [https://github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082](https://redirect.github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082)\n-
        [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
        [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
        [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-4633-3j49-mh5q)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        Next.js: Unbounded Server Action payload in Edge runtime\n[CVE-2026-64646](https://nvd.nist.gov/vuln/detail/CVE-2026-64646)
        / [GHSA-4c39-4ccg-62r3](https://redirect.github.com/advisories/GHSA-4c39-4ccg-62r3)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Impact\n\nRequests targeting
        Next.js applications using App Router with at least one Server Action can
        lead to excessive memory consumption if that Server Actions uses the Edge
        runtime\n\n##### Workarounds\n\nIf you cannot upgrade, ensure your hosting
        provider limits the request's body size. 5 MiB should be allowed at max by
        your hosting provider.\n\n#### Severity\n- CVSS Score: 6.3 / 10 (Medium)\n-
        Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`\n\n####
        References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3)\n-
        [https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4](https://redirect.github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4)\n-
        [https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17](https://redirect.github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17)\n-
        [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
        [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
        [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        Next.js: Cache confusion of response bodies for requests with bodies\n[CVE-2026-64648](https://nvd.nist.gov/vuln/detail/CVE-2026-64648)
        / [GHSA-68g3-v927-f742](https://redirect.github.com/advisories/GHSA-68g3-v927-f742)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Impact\n\nA server-side `fetch`
        with a request body may return a cached **response** body from a different
        request to the same URL but different body. Confidential data in the `POST`'s
        **response** body would then leak to unauthorized requests. Though the request
        itself will not be deduped.\n\nThis only applies to `fetch` calls with a request
        that has a different init than the one passed to `fetch`.\nSafe: `fetch(new
        Request(init), init)`\nUnsafe: `fetch(new Request(init), aDifferentInit)`\n\n#####
        Workarounds\n\nNo workaround exists besides upgrading. Applications using
        Pages Router are not vulnerable.\n\n#### Severity\n- CVSS Score: 6.0 / 10
        (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`\n\n####
        References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742)\n-
        [https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c](https://redirect.github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c)\n-
        [https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a](https://redirect.github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a)\n-
        [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
        [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
        [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-68g3-v927-f742)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        Next.js: Middleware / Proxy bypass in App Router applications using Turbopack
        and single locale\n[CVE-2026-64642](https://nvd.nist.gov/vuln/detail/CVE-2026-64642)
        / [GHSA-6gpp-xcg3-4w24](https://redirect.github.com/advisories/GHSA-6gpp-xcg3-4w24)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Impact\n\nCrafted requests targeting
        Next.js applications using App Router built with Turbopack and a **single**
        entry in `config.i18n.locales` can bypass middleware/proxy based authentication.\n\n#####
        Workarounds\n\nIf you cannot upgrade immediately, enforce authorization in
        the page's server-side data path instead of relying solely on middleware.\n\n####
        Severity\n- CVSS Score: 8.3 / 10 (High)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`\n\n####
        References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24)\n-
        [https://github.com/vercel/next.js/pull/96014](https://redirect.github.com/vercel/next.js/pull/96014)\n-
        [https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151](https://redirect.github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151)\n-
        [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
        [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6gpp-xcg3-4w24)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        Next.js: Server-Side Request Forgery in Server Actions on custom servers\n[CVE-2026-64649](https://nvd.nist.gov/vuln/detail/CVE-2026-64649)
        / [GHSA-89xv-2m56-2m9x](https://redirect.github.com/advisories/GHSA-89xv-2m56-2m9x)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Impact\n\nWhen a Server Action
        forwards or redirects a request, an attacker can cause the server to send
        that outbound request to a malicious host (Server-Side Request Forgery). This
        requires the attacker's request to control Host-associated headers. In some
        configurations, it's also possible to obtain internal values that weaken middleware/proxy
        authorization.\n\nApplications that use Server Actions are affected when the
        incoming host header is not fixed to a trusted value. This typically occurs
        on custom servers, or on deployments not behind a proxy that pins the host.
        Managed hosting pins the host upstream and is not affected; `next start` and
        standalone output do the same from version 14.2 onward.\n\n##### Workarounds\n\nIf
        you cannot upgrade, ensure clients do not control the host header your application
        receives. Pin or validate `Host` and `X-Forwarded-Host` at your edge or proxy.
        On version 14.2.0 and later, you can additionally set the `__NEXT_PRIVATE_ORIGIN`
        environment variable to your deployment's real origin:\n\n```bash\n__NEXT_PRIVATE_ORIGIN=https://www.example.com
        node server.js\n\n#### Severity\n- CVSS Score: 8.3 / 10 (High)\n- Vector String:
        `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`\n\n####
        References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x)\n-
        [https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b](https://redirect.github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b)\n-
        [https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498](https://redirect.github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498)\n-
        [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
        [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
        [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        Next.js: Unauthenticated disclosure of internal Server Function endpoints\n[CVE-2026-64643](https://nvd.nist.gov/vuln/detail/CVE-2026-64643)
        / [GHSA-955p-x3mx-jcvp](https://redirect.github.com/advisories/GHSA-955p-x3mx-jcvp)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Impact\n\nIn Next.js applications
        using App Router, Server Actions (`use server`) or `use cache` endpoints can
        be disclosed bypassing any authentication on the pages where these endpoints
        are usually used.\n\nServer Action IDs can be disclosed to unauthenticated
        users via publicly served client artifacts (for example, static chunks containing
        action references).\n\nAffected users are applications using App Router +
        Server Actions.  \n\nBy itself, this disclosure is typically a recon/enumeration
        primitive; however, it can increase risk when combined with other weaknesses.\n
        \n\n##### Workarounds\n\nNever assume any authentication claims at the `use
        cache` or `use server` boundary. Always authenticate within the boundary.\n\n####
        Severity\n- CVSS Score: 6.3 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N`\n\n####
        References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp)\n-
        [https://github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3](https://redirect.github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3)\n-
        [https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b](https://redirect.github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b)\n-
        [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
        [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
        [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-955p-x3mx-jcvp)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        Next.js: Denial of Service in App Router using Server Actions\n[CVE-2026-64641](https://nvd.nist.gov/vuln/detail/CVE-2026-64641)
        / [GHSA-m99w-x7hq-7vfj](https://redirect.github.com/advisories/GHSA-m99w-x7hq-7vfj)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Impact\n\nCrafted requests targeting
        Next.js applications using App Router with at least one Server Action can
        lead to excessive CPU usage blocking processing of further requests in the
        same process.\n\n##### Workarounds\n\nNo workaround exists besides upgrading.
        Applications using Pages Router or not using Server Actions are not vulnerable.\n\n####
        Severity\n- CVSS Score: 8.2 / 10 (High)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`\n\n####
        References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj)\n-
        [https://github.com/vercel/next.js/pull/96013](https://redirect.github.com/vercel/next.js/pull/96013)\n-
        [https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12](https://redirect.github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12)\n-
        [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
        [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
        [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination
        hostname\n[CVE-2026-64645](https://nvd.nist.gov/vuln/detail/CVE-2026-64645)
        / [GHSA-p9j2-gv94-2wf4](https://redirect.github.com/advisories/GHSA-p9j2-gv94-2wf4)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Impact\n\nA `rewrites()` or `redirects()`
        rule that builds its external destination hostname from request-controlled
        input can be pointed at an arbitrary hostname, regardless of the rule's\_hostname
        suffix. For a rewrite, Next.js proxies the request to that arbitrary host
        and serves the response from the application's origin, leading to Server-Side
        Request forgery. A `redirects()` rule configured this way is vulnerable to
        an Open Redirect.\n\nThis affects any destination that puts a dynamic segment
        in the hostname, whether from the path:\n\n```javascript\n// next.config.js\nmodule.exports
        = {\n  async rewrites() {\n    return [\n      {\n        source: '/:tenant',\n
        \       destination: 'https://:tenant.api.example.com',\n      },\n    ]\n
        \ },\n}\n```\n\nor from a `has` capture:\n\n```javascript\n// next.config.js\nmodule.exports
        = {\n  async rewrites() {\n    return [\n      {\n        source: '/',\n        has:
        [{ type: 'query', key: 'region', value: '(?<region>.+)' }],\n        destination:
        'https://:region.api.example.com',\n      },\n    ]\n  },\n}\n```\n\n#####
        Workarounds\n\nIf you cannot upgrade immediately, do not build the hostname
        of an external `rewrites()` or `redirects()` destination from user-controlled
        input. If a dynamic subdomain is required, constrain the value to hostname-safe
        characters:  `value: '(?<region>[a-z0-9-]+)'`.\n\n#### Severity\n- CVSS Score:
        8.3 / 10 (High)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N`\n\n####
        References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4)\n-
        [https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9](https://redirect.github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9)\n-
        [https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599](https://redirect.github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599)\n-
        [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
        [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
        [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        Next.js: Denial of Service in the Image Optimization API using SVGs\n[CVE-2026-64644](https://nvd.nist.gov/vuln/detail/CVE-2026-64644)
        / [GHSA-q8wf-6r8g-63ch](https://redirect.github.com/advisories/GHSA-q8wf-6r8g-63ch)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Impact\n\nWhen self-hosting Next.js
        with the default image loader, the Image Optimization API can optimize remotely
        hosted images if configured (not enabled by default). If those images contain
        malicious content, they can cause CPU exhaustion in  `/_next/image` endpoints.\n\n-
        If you are using `config.images.remotePatterns`, only the patterns in that
        array are impacted.\n- If you are using `config.images.unoptimized: true`,
        you are NOT impacted.\n- If you are using `config.images.loader: 'custom'`,
        you are NOT impacted.\n- If you are using Vercel, you are NOT impacted.\n\n#####
        Workarounds\n\nIf you cannot upgrade immediately, you can avoid the expensive
        work by setting `config.experimental.imgOptSkipMetadata : true`.\n\n#### Severity\n-
        CVSS Score: 6.3 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`\n\n####
        References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch)\n-
        [https://github.com/vercel/next.js/pull/96006](https://redirect.github.com/vercel/next.js/pull/96006)\n-
        [https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c](https://redirect.github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c)\n-
        [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
        [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
        [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-q8wf-6r8g-63ch)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        Release Notes\n\n<details>\n<summary>vercel/next.js (next)</summary>\n\n###
        [`v16.2.11`](https://redirect.github.com/vercel/next.js/compare/v16.2.10...v16.2.11)\n\n[Compare
        Source](https://redirect.github.com/vercel/next.js/compare/v16.2.10...v16.2.11)\n\n</details>\n\n---\n\n###
        Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
        At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
        defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
        manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
        conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
        Close this PR and you won't be reminded about this update again.\n\n---\n\n
        - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
        box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
        View the [repository job log](https://developer.mend.io/github/osism/python-osism).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzUuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI3NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
      change_url: https://github.com/osism/python-osism/pull/2505
      child_jobs: []
      commit_id: 198f264c96655fe2c1029802caad50251383d36f
      event_id: 580246e0-863c-11f1-93aa-8eed064c59a6
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/d7033e5b9be24badb780e3b5b9918dd9/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/d7033e5b9be24badb780e3b5b9918dd9/work/logs
        result_data_file: /var/lib/zuul/builds/d7033e5b9be24badb780e3b5b9918dd9/work/results.json
        src_root: /var/lib/zuul/builds/d7033e5b9be24badb780e3b5b9918dd9/work/src
        work_root: /var/lib/zuul/builds/d7033e5b9be24badb780e3b5b9918dd9/work
      include_vars: []
      items:
      - branch: main
        change: '2505'
        change_message: "Update dependency next to v16.2.11 [SECURITY]\n\nThis PR
          contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [next](https://nextjs.org) ([source](https://redirect.github.com/vercel/next.js))
          | [`16.2.10` \u2192 `16.2.11`](https://renovatebot.com/diffs/npm/next/16.2.10/16.2.11)
          | ![age](https://developer.mend.io/api/mc/badges/age/npm/next/16.2.11?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/next/16.2.10/16.2.11?slim=true)
          |\n\n---\n\n### Next.js: Cache confusion of response bodies for requests
          with bodies containing invalid UTF-8 byte sequences\n[CVE-2026-64647](https://nvd.nist.gov/vuln/detail/CVE-2026-64647)
          / [GHSA-4633-3j49-mh5q](https://redirect.github.com/advisories/GHSA-4633-3j49-mh5q)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nA server-side `fetch`
          with a request body may return a cached **response** body from a different
          request to the same URL but different body. Confidential data in the `POST`'s
          **response** body would then leak to unauthorized requests. Though the request
          itself will not be deduped.\n\nThis is only an issue when receiving request
          bodies with a content type charset other than UTF-8. For example, the UTF-16
          byte sequences for `\uC083\uC083` and `\uC104\uC104` in the request body
          would share the same cache.\n\n##### Workarounds\n\nIf you cannot upgrade,
          consider only making fetch requests with UTF-8 bodies (default in Next.js).
          Applications using Pages Router are not vulnerable.\n\n#### Severity\n-
          CVSS Score: 6.3 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q)\n-
          [https://github.com/vercel/next.js/pull/96008](https://redirect.github.com/vercel/next.js/pull/96008)\n-
          [https://github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082](https://redirect.github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-4633-3j49-mh5q)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Unbounded Server Action payload in Edge runtime\n[CVE-2026-64646](https://nvd.nist.gov/vuln/detail/CVE-2026-64646)
          / [GHSA-4c39-4ccg-62r3](https://redirect.github.com/advisories/GHSA-4c39-4ccg-62r3)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nRequests targeting
          Next.js applications using App Router with at least one Server Action can
          lead to excessive memory consumption if that Server Actions uses the Edge
          runtime\n\n##### Workarounds\n\nIf you cannot upgrade, ensure your hosting
          provider limits the request's body size. 5 MiB should be allowed at max
          by your hosting provider.\n\n#### Severity\n- CVSS Score: 6.3 / 10 (Medium)\n-
          Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3)\n-
          [https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4](https://redirect.github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4)\n-
          [https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17](https://redirect.github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Cache confusion of response bodies for requests with bodies\n[CVE-2026-64648](https://nvd.nist.gov/vuln/detail/CVE-2026-64648)
          / [GHSA-68g3-v927-f742](https://redirect.github.com/advisories/GHSA-68g3-v927-f742)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nA server-side `fetch`
          with a request body may return a cached **response** body from a different
          request to the same URL but different body. Confidential data in the `POST`'s
          **response** body would then leak to unauthorized requests. Though the request
          itself will not be deduped.\n\nThis only applies to `fetch` calls with a
          request that has a different init than the one passed to `fetch`.\nSafe:
          `fetch(new Request(init), init)`\nUnsafe: `fetch(new Request(init), aDifferentInit)`\n\n#####
          Workarounds\n\nNo workaround exists besides upgrading. Applications using
          Pages Router are not vulnerable.\n\n#### Severity\n- CVSS Score: 6.0 / 10
          (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742)\n-
          [https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c](https://redirect.github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c)\n-
          [https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a](https://redirect.github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-68g3-v927-f742)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Middleware / Proxy bypass in App Router applications using Turbopack
          and single locale\n[CVE-2026-64642](https://nvd.nist.gov/vuln/detail/CVE-2026-64642)
          / [GHSA-6gpp-xcg3-4w24](https://redirect.github.com/advisories/GHSA-6gpp-xcg3-4w24)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nCrafted requests
          targeting Next.js applications using App Router built with Turbopack and
          a **single** entry in `config.i18n.locales` can bypass middleware/proxy
          based authentication.\n\n##### Workarounds\n\nIf you cannot upgrade immediately,
          enforce authorization in the page's server-side data path instead of relying
          solely on middleware.\n\n#### Severity\n- CVSS Score: 8.3 / 10 (High)\n-
          Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24)\n-
          [https://github.com/vercel/next.js/pull/96014](https://redirect.github.com/vercel/next.js/pull/96014)\n-
          [https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151](https://redirect.github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6gpp-xcg3-4w24)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Server-Side Request Forgery in Server Actions on custom servers\n[CVE-2026-64649](https://nvd.nist.gov/vuln/detail/CVE-2026-64649)
          / [GHSA-89xv-2m56-2m9x](https://redirect.github.com/advisories/GHSA-89xv-2m56-2m9x)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nWhen a Server Action
          forwards or redirects a request, an attacker can cause the server to send
          that outbound request to a malicious host (Server-Side Request Forgery).
          This requires the attacker's request to control Host-associated headers.
          In some configurations, it's also possible to obtain internal values that
          weaken middleware/proxy authorization.\n\nApplications that use Server Actions
          are affected when the incoming host header is not fixed to a trusted value.
          This typically occurs on custom servers, or on deployments not behind a
          proxy that pins the host. Managed hosting pins the host upstream and is
          not affected; `next start` and standalone output do the same from version
          14.2 onward.\n\n##### Workarounds\n\nIf you cannot upgrade, ensure clients
          do not control the host header your application receives. Pin or validate
          `Host` and `X-Forwarded-Host` at your edge or proxy. On version 14.2.0 and
          later, you can additionally set the `__NEXT_PRIVATE_ORIGIN` environment
          variable to your deployment's real origin:\n\n```bash\n__NEXT_PRIVATE_ORIGIN=https://www.example.com
          node server.js\n\n#### Severity\n- CVSS Score: 8.3 / 10 (High)\n- Vector
          String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x)\n-
          [https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b](https://redirect.github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b)\n-
          [https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498](https://redirect.github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Unauthenticated disclosure of internal Server Function endpoints\n[CVE-2026-64643](https://nvd.nist.gov/vuln/detail/CVE-2026-64643)
          / [GHSA-955p-x3mx-jcvp](https://redirect.github.com/advisories/GHSA-955p-x3mx-jcvp)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nIn Next.js applications
          using App Router, Server Actions (`use server`) or `use cache` endpoints
          can be disclosed bypassing any authentication on the pages where these endpoints
          are usually used.\n\nServer Action IDs can be disclosed to unauthenticated
          users via publicly served client artifacts (for example, static chunks containing
          action references).\n\nAffected users are applications using App Router
          + Server Actions.  \n\nBy itself, this disclosure is typically a recon/enumeration
          primitive; however, it can increase risk when combined with other weaknesses.\n
          \n\n##### Workarounds\n\nNever assume any authentication claims at the `use
          cache` or `use server` boundary. Always authenticate within the boundary.\n\n####
          Severity\n- CVSS Score: 6.3 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp)\n-
          [https://github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3](https://redirect.github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3)\n-
          [https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b](https://redirect.github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-955p-x3mx-jcvp)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Denial of Service in App Router using Server Actions\n[CVE-2026-64641](https://nvd.nist.gov/vuln/detail/CVE-2026-64641)
          / [GHSA-m99w-x7hq-7vfj](https://redirect.github.com/advisories/GHSA-m99w-x7hq-7vfj)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nCrafted requests
          targeting Next.js applications using App Router with at least one Server
          Action can lead to excessive CPU usage blocking processing of further requests
          in the same process.\n\n##### Workarounds\n\nNo workaround exists besides
          upgrading. Applications using Pages Router or not using Server Actions are
          not vulnerable.\n\n#### Severity\n- CVSS Score: 8.2 / 10 (High)\n- Vector
          String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj)\n-
          [https://github.com/vercel/next.js/pull/96013](https://redirect.github.com/vercel/next.js/pull/96013)\n-
          [https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12](https://redirect.github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Server-Side Request Forgery in rewrites via attacker-controlled
          destination hostname\n[CVE-2026-64645](https://nvd.nist.gov/vuln/detail/CVE-2026-64645)
          / [GHSA-p9j2-gv94-2wf4](https://redirect.github.com/advisories/GHSA-p9j2-gv94-2wf4)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nA `rewrites()` or
          `redirects()` rule that builds its external destination hostname from request-controlled
          input can be pointed at an arbitrary hostname, regardless of the rule's\_hostname
          suffix. For a rewrite, Next.js proxies the request to that arbitrary host
          and serves the response from the application's origin, leading to Server-Side
          Request forgery. A `redirects()` rule configured this way is vulnerable
          to an Open Redirect.\n\nThis affects any destination that puts a dynamic
          segment in the hostname, whether from the path:\n\n```javascript\n// next.config.js\nmodule.exports
          = {\n  async rewrites() {\n    return [\n      {\n        source: '/:tenant',\n
          \       destination: 'https://:tenant.api.example.com',\n      },\n    ]\n
          \ },\n}\n```\n\nor from a `has` capture:\n\n```javascript\n// next.config.js\nmodule.exports
          = {\n  async rewrites() {\n    return [\n      {\n        source: '/',\n
          \       has: [{ type: 'query', key: 'region', value: '(?<region>.+)' }],\n
          \       destination: 'https://:region.api.example.com',\n      },\n    ]\n
          \ },\n}\n```\n\n##### Workarounds\n\nIf you cannot upgrade immediately,
          do not build the hostname of an external `rewrites()` or `redirects()` destination
          from user-controlled input. If a dynamic subdomain is required, constrain
          the value to hostname-safe characters:  `value: '(?<region>[a-z0-9-]+)'`.\n\n####
          Severity\n- CVSS Score: 8.3 / 10 (High)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4)\n-
          [https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9](https://redirect.github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9)\n-
          [https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599](https://redirect.github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Next.js: Denial of Service in the Image Optimization API using SVGs\n[CVE-2026-64644](https://nvd.nist.gov/vuln/detail/CVE-2026-64644)
          / [GHSA-q8wf-6r8g-63ch](https://redirect.github.com/advisories/GHSA-q8wf-6r8g-63ch)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Impact\n\nWhen self-hosting
          Next.js with the default image loader, the Image Optimization API can optimize
          remotely hosted images if configured (not enabled by default). If those
          images contain malicious content, they can cause CPU exhaustion in  `/_next/image`
          endpoints.\n\n- If you are using `config.images.remotePatterns`, only the
          patterns in that array are impacted.\n- If you are using `config.images.unoptimized:
          true`, you are NOT impacted.\n- If you are using `config.images.loader:
          'custom'`, you are NOT impacted.\n- If you are using Vercel, you are NOT
          impacted.\n\n##### Workarounds\n\nIf you cannot upgrade immediately, you
          can avoid the expensive work by setting `config.experimental.imgOptSkipMetadata
          : true`.\n\n#### Severity\n- CVSS Score: 6.3 / 10 (Medium)\n- Vector String:
          `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch)\n-
          [https://github.com/vercel/next.js/pull/96006](https://redirect.github.com/vercel/next.js/pull/96006)\n-
          [https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c](https://redirect.github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c)\n-
          [https://github.com/vercel/next.js](https://redirect.github.com/vercel/next.js)\n-
          [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)\n-
          [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-q8wf-6r8g-63ch)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Release Notes\n\n<details>\n<summary>vercel/next.js (next)</summary>\n\n###
          [`v16.2.11`](https://redirect.github.com/vercel/next.js/compare/v16.2.10...v16.2.11)\n\n[Compare
          Source](https://redirect.github.com/vercel/next.js/compare/v16.2.10...v16.2.11)\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
          manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
          conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
          Close this PR and you won't be reminded about this update again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/python-osism).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzUuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI3NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/python-osism/pull/2505
        commit_id: 198f264c96655fe2c1029802caad50251383d36f
        patchset: 198f264c96655fe2c1029802caad50251383d36f
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          name: osism/python-osism
          short_name: python-osism
          src_dir: src/github.com/osism/python-osism
        topic: null
      job: flake8
      jobtags: []
      max_attempts: 3
      message: VXBkYXRlIGRlcGVuZGVuY3kgbmV4dCB0byB2MTYuMi4xMSBbU0VDVVJJVFldCgpUaGlzIFBSIGNvbnRhaW5zIHRoZSBmb2xsb3dpbmcgdXBkYXRlczoKCnwgUGFja2FnZSB8IENoYW5nZSB8IFtBZ2VdKGh0dHBzOi8vZG9jcy5yZW5vdmF0ZWJvdC5jb20vbWVyZ2UtY29uZmlkZW5jZS8pIHwgW0NvbmZpZGVuY2VdKGh0dHBzOi8vZG9jcy5yZW5vdmF0ZWJvdC5jb20vbWVyZ2UtY29uZmlkZW5jZS8pIHwKfC0tLXwtLS18LS0tfC0tLXwKfCBbbmV4dF0oaHR0cHM6Ly9uZXh0anMub3JnKSAoW3NvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzKSkgfCBbYDE2LjIuMTBgIOKGkiBgMTYuMi4xMWBdKGh0dHBzOi8vcmVub3ZhdGVib3QuY29tL2RpZmZzL25wbS9uZXh0LzE2LjIuMTAvMTYuMi4xMSkgfCAhW2FnZV0oaHR0cHM6Ly9kZXZlbG9wZXIubWVuZC5pby9hcGkvbWMvYmFkZ2VzL2FnZS9ucG0vbmV4dC8xNi4yLjExP3NsaW09dHJ1ZSkgfCAhW2NvbmZpZGVuY2VdKGh0dHBzOi8vZGV2ZWxvcGVyLm1lbmQuaW8vYXBpL21jL2JhZGdlcy9jb25maWRlbmNlL25wbS9uZXh0LzE2LjIuMTAvMTYuMi4xMT9zbGltPXRydWUpIHwKCi0tLQoKIyMjIE5leHQuanM6IENhY2hlIGNvbmZ1c2lvbiBvZiByZXNwb25zZSBib2RpZXMgZm9yIHJlcXVlc3RzIHdpdGggYm9kaWVzIGNvbnRhaW5pbmcgaW52YWxpZCBVVEYtOCBieXRlIHNlcXVlbmNlcwpbQ1ZFLTIwMjYtNjQ2NDddKGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDI2LTY0NjQ3KSAvIFtHSFNBLTQ2MzMtM2o0OS1taDVxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYWR2aXNvcmllcy9HSFNBLTQ2MzMtM2o0OS1taDVxKQoKPGRldGFpbHM+CjxzdW1tYXJ5Pk1vcmUgaW5mb3JtYXRpb248L3N1bW1hcnk+CgojIyMjIERldGFpbHMKIyMjIyMgSW1wYWN0CgpBIHNlcnZlci1zaWRlIGBmZXRjaGAgd2l0aCBhIHJlcXVlc3QgYm9keSBtYXkgcmV0dXJuIGEgY2FjaGVkICoqcmVzcG9uc2UqKiBib2R5IGZyb20gYSBkaWZmZXJlbnQgcmVxdWVzdCB0byB0aGUgc2FtZSBVUkwgYnV0IGRpZmZlcmVudCBib2R5LiBDb25maWRlbnRpYWwgZGF0YSBpbiB0aGUgYFBPU1RgJ3MgKipyZXNwb25zZSoqIGJvZHkgd291bGQgdGhlbiBsZWFrIHRvIHVuYXV0aG9yaXplZCByZXF1ZXN0cy4gVGhvdWdoIHRoZSByZXF1ZXN0IGl0c2VsZiB3aWxsIG5vdCBiZSBkZWR1cGVkLgoKVGhpcyBpcyBvbmx5IGFuIGlzc3VlIHdoZW4gcmVjZWl2aW5nIHJlcXVlc3QgYm9kaWVzIHdpdGggYSBjb250ZW50IHR5cGUgY2hhcnNldCBvdGhlciB0aGFuIFVURi04LiBGb3IgZXhhbXBsZSwgdGhlIFVURi0xNiBieXRlIHNlcXVlbmNlcyBmb3IgYOyCg+yCg2AgYW5kIGDshITshIRgIGluIHRoZSByZXF1ZXN0IGJvZHkgd291bGQgc2hhcmUgdGhlIHNhbWUgY2FjaGUuCgojIyMjIyBXb3JrYXJvdW5kcwoKSWYgeW91IGNhbm5vdCB1cGdyYWRlLCBjb25zaWRlciBvbmx5IG1ha2luZyBmZXRjaCByZXF1ZXN0cyB3aXRoIFVURi04IGJvZGllcyAoZGVmYXVsdCBpbiBOZXh0LmpzKS4gQXBwbGljYXRpb25zIHVzaW5nIFBhZ2VzIFJvdXRlciBhcmUgbm90IHZ1bG5lcmFibGUuCgojIyMjIFNldmVyaXR5Ci0gQ1ZTUyBTY29yZTogNi4zIC8gMTAgKE1lZGl1bSkKLSBWZWN0b3IgU3RyaW5nOiBgQ1ZTUzo0LjAvQVY6Ti9BQzpIL0FUOlAvUFI6Ti9VSTpOL1ZDOkwvVkk6TC9WQTpOL1NDOk4vU0k6Ti9TQTpOYAoKIyMjIyBSZWZlcmVuY2VzCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtNDYzMy0zajQ5LW1oNXFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtNDYzMy0zajQ5LW1oNXEpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9wdWxsLzk2MDA4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvcHVsbC85NjAwOCkKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL2NvbW1pdC8wMjViZjRhNWY3YjQ3ZmI3NzU4YzRlYmYxYzkzMWE2MWM0NTFjMDgyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvY29tbWl0LzAyNWJmNGE1ZjdiNDdmYjc3NThjNGViZjFjOTMxYTYxYzQ1MWMwODIpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qc10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzKQotIFtodHRwczovL2dpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvcmVsZWFzZXMvdGFnL3YxNS41LjIxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvcmVsZWFzZXMvdGFnL3YxNS41LjIxKQotIFtodHRwczovL2dpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvcmVsZWFzZXMvdGFnL3YxNi4yLjExXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvcmVsZWFzZXMvdGFnL3YxNi4yLjExKQoKVGhpcyBkYXRhIGlzIHByb3ZpZGVkIGJ5IFtPU1ZdKGh0dHBzOi8vb3N2LmRldi92dWxuZXJhYmlsaXR5L0dIU0EtNDYzMy0zajQ5LW1oNXEpIGFuZCB0aGUgW0dpdEh1YiBBZHZpc29yeSBEYXRhYmFzZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdGh1Yi9hZHZpc29yeS1kYXRhYmFzZSkgKFtDQy1CWSA0LjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRodWIvYWR2aXNvcnktZGF0YWJhc2UvYmxvYi9tYWluL0xJQ0VOU0UubWQpKS4KPC9kZXRhaWxzPgoKLS0tCgojIyMgTmV4dC5qczogVW5ib3VuZGVkIFNlcnZlciBBY3Rpb24gcGF5bG9hZCBpbiBFZGdlIHJ1bnRpbWUKW0NWRS0yMDI2LTY0NjQ2XShodHRwczovL252ZC5uaXN0Lmdvdi92dWxuL2RldGFpbC9DVkUtMjAyNi02NDY0NikgLyBbR0hTQS00YzM5LTRjY2ctNjJyM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2Fkdmlzb3JpZXMvR0hTQS00YzM5LTRjY2ctNjJyMykKCjxkZXRhaWxzPgo8c3VtbWFyeT5Nb3JlIGluZm9ybWF0aW9uPC9zdW1tYXJ5PgoKIyMjIyBEZXRhaWxzCiMjIyMjIEltcGFjdAoKUmVxdWVzdHMgdGFyZ2V0aW5nIE5leHQuanMgYXBwbGljYXRpb25zIHVzaW5nIEFwcCBSb3V0ZXIgd2l0aCBhdCBsZWFzdCBvbmUgU2VydmVyIEFjdGlvbiBjYW4gbGVhZCB0byBleGNlc3NpdmUgbWVtb3J5IGNvbnN1bXB0aW9uIGlmIHRoYXQgU2VydmVyIEFjdGlvbnMgdXNlcyB0aGUgRWRnZSBydW50aW1lCgojIyMjIyBXb3JrYXJvdW5kcwoKSWYgeW91IGNhbm5vdCB1cGdyYWRlLCBlbnN1cmUgeW91ciBob3N0aW5nIHByb3ZpZGVyIGxpbWl0cyB0aGUgcmVxdWVzdCdzIGJvZHkgc2l6ZS4gNSBNaUIgc2hvdWxkIGJlIGFsbG93ZWQgYXQgbWF4IGJ5IHlvdXIgaG9zdGluZyBwcm92aWRlci4KCiMjIyMgU2V2ZXJpdHkKLSBDVlNTIFNjb3JlOiA2LjMgLyAxMCAoTWVkaXVtKQotIFZlY3RvciBTdHJpbmc6IGBDVlNTOjQuMC9BVjpOL0FDOkwvQVQ6UC9QUjpOL1VJOk4vVkM6Ti9WSTpOL1ZBOkwvU0M6Ti9TSTpOL1NBOk5gCgojIyMjIFJlZmVyZW5jZXMKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS00YzM5LTRjY2ctNjJyM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS00YzM5LTRjY2ctNjJyMykKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL2NvbW1pdC81N2MzMWY3MjRkNzQ2ZTg2YTllOGI5MmFhOGJlNTM4YTkyMjQ0NmE0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvY29tbWl0LzU3YzMxZjcyNGQ3NDZlODZhOWU4YjkyYWE4YmU1MzhhOTIyNDQ2YTQpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9jb21taXQvOWE0NjUxZTc1NGY3MGIxMmUzOTc2OTRmZmM0MWY0NGMzYmE4Y2MxN10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL2NvbW1pdC85YTQ2NTFlNzU0ZjcwYjEyZTM5NzY5NGZmYzQxZjQ0YzNiYThjYzE3KQotIFtodHRwczovL2dpdGh1Yi5jb20vdmVyY2VsL25leHQuanNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcykKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3JlbGVhc2VzL3RhZy92MTUuNS4yMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3JlbGVhc2VzL3RhZy92MTUuNS4yMSkKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3JlbGVhc2VzL3RhZy92MTYuMi4xMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3JlbGVhc2VzL3RhZy92MTYuMi4xMSkKClRoaXMgZGF0YSBpcyBwcm92aWRlZCBieSBbT1NWXShodHRwczovL29zdi5kZXYvdnVsbmVyYWJpbGl0eS9HSFNBLTRjMzktNGNjZy02MnIzKSBhbmQgdGhlIFtHaXRIdWIgQWR2aXNvcnkgRGF0YWJhc2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRodWIvYWR2aXNvcnktZGF0YWJhc2UpIChbQ0MtQlkgNC4wXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0aHViL2Fkdmlzb3J5LWRhdGFiYXNlL2Jsb2IvbWFpbi9MSUNFTlNFLm1kKSkuCjwvZGV0YWlscz4KCi0tLQoKIyMjIE5leHQuanM6IENhY2hlIGNvbmZ1c2lvbiBvZiByZXNwb25zZSBib2RpZXMgZm9yIHJlcXVlc3RzIHdpdGggYm9kaWVzCltDVkUtMjAyNi02NDY0OF0oaHR0cHM6Ly9udmQubmlzdC5nb3YvdnVsbi9kZXRhaWwvQ1ZFLTIwMjYtNjQ2NDgpIC8gW0dIU0EtNjhnMy12OTI3LWY3NDJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hZHZpc29yaWVzL0dIU0EtNjhnMy12OTI3LWY3NDIpCgo8ZGV0YWlscz4KPHN1bW1hcnk+TW9yZSBpbmZvcm1hdGlvbjwvc3VtbWFyeT4KCiMjIyMgRGV0YWlscwojIyMjIyBJbXBhY3QKCkEgc2VydmVyLXNpZGUgYGZldGNoYCB3aXRoIGEgcmVxdWVzdCBib2R5IG1heSByZXR1cm4gYSBjYWNoZWQgKipyZXNwb25zZSoqIGJvZHkgZnJvbSBhIGRpZmZlcmVudCByZXF1ZXN0IHRvIHRoZSBzYW1lIFVSTCBidXQgZGlmZmVyZW50IGJvZHkuIENvbmZpZGVudGlhbCBkYXRhIGluIHRoZSBgUE9TVGAncyAqKnJlc3BvbnNlKiogYm9keSB3b3VsZCB0aGVuIGxlYWsgdG8gdW5hdXRob3JpemVkIHJlcXVlc3RzLiBUaG91Z2ggdGhlIHJlcXVlc3QgaXRzZWxmIHdpbGwgbm90IGJlIGRlZHVwZWQuCgpUaGlzIG9ubHkgYXBwbGllcyB0byBgZmV0Y2hgIGNhbGxzIHdpdGggYSByZXF1ZXN0IHRoYXQgaGFzIGEgZGlmZmVyZW50IGluaXQgdGhhbiB0aGUgb25lIHBhc3NlZCB0byBgZmV0Y2hgLgpTYWZlOiBgZmV0Y2gobmV3IFJlcXVlc3QoaW5pdCksIGluaXQpYApVbnNhZmU6IGBmZXRjaChuZXcgUmVxdWVzdChpbml0KSwgYURpZmZlcmVudEluaXQpYAoKIyMjIyMgV29ya2Fyb3VuZHMKCk5vIHdvcmthcm91bmQgZXhpc3RzIGJlc2lkZXMgdXBncmFkaW5nLiBBcHBsaWNhdGlvbnMgdXNpbmcgUGFnZXMgUm91dGVyIGFyZSBub3QgdnVsbmVyYWJsZS4KCiMjIyMgU2V2ZXJpdHkKLSBDVlNTIFNjb3JlOiA2LjAgLyAxMCAoTWVkaXVtKQotIFZlY3RvciBTdHJpbmc6IGBDVlNTOjQuMC9BVjpOL0FDOkwvQVQ6UC9QUjpOL1VJOlAvVkM6SC9WSTpML1ZBOk4vU0M6Ti9TSTpOL1NBOk5gCgojIyMjIFJlZmVyZW5jZXMKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS02OGczLXY5MjctZjc0Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS02OGczLXY5MjctZjc0MikKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL2NvbW1pdC8wNjJmNjY3MDBiNTJhNWQ2YmJhMmMwNjA1ZDU1NTc3YWI3YWQyNjJjXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvY29tbWl0LzA2MmY2NjcwMGI1MmE1ZDZiYmEyYzA2MDVkNTU1NzdhYjdhZDI2MmMpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9jb21taXQvNzNiOTQ4NzJiYzM0M2QwOTQ5NGI1MDM5NGQ4YzA4ZWI5ZmM4ZTU2YV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL2NvbW1pdC83M2I5NDg3MmJjMzQzZDA5NDk0YjUwMzk0ZDhjMDhlYjlmYzhlNTZhKQotIFtodHRwczovL2dpdGh1Yi5jb20vdmVyY2VsL25leHQuanNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcykKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3JlbGVhc2VzL3RhZy92MTUuNS4yMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3JlbGVhc2VzL3RhZy92MTUuNS4yMSkKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3JlbGVhc2VzL3RhZy92MTYuMi4xMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3JlbGVhc2VzL3RhZy92MTYuMi4xMSkKClRoaXMgZGF0YSBpcyBwcm92aWRlZCBieSBbT1NWXShodHRwczovL29zdi5kZXYvdnVsbmVyYWJpbGl0eS9HSFNBLTY4ZzMtdjkyNy1mNzQyKSBhbmQgdGhlIFtHaXRIdWIgQWR2aXNvcnkgRGF0YWJhc2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRodWIvYWR2aXNvcnktZGF0YWJhc2UpIChbQ0MtQlkgNC4wXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0aHViL2Fkdmlzb3J5LWRhdGFiYXNlL2Jsb2IvbWFpbi9MSUNFTlNFLm1kKSkuCjwvZGV0YWlscz4KCi0tLQoKIyMjIE5leHQuanM6IE1pZGRsZXdhcmUgLyBQcm94eSBieXBhc3MgaW4gQXBwIFJvdXRlciBhcHBsaWNhdGlvbnMgdXNpbmcgVHVyYm9wYWNrIGFuZCBzaW5nbGUgbG9jYWxlCltDVkUtMjAyNi02NDY0Ml0oaHR0cHM6Ly9udmQubmlzdC5nb3YvdnVsbi9kZXRhaWwvQ1ZFLTIwMjYtNjQ2NDIpIC8gW0dIU0EtNmdwcC14Y2czLTR3MjRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hZHZpc29yaWVzL0dIU0EtNmdwcC14Y2czLTR3MjQpCgo8ZGV0YWlscz4KPHN1bW1hcnk+TW9yZSBpbmZvcm1hdGlvbjwvc3VtbWFyeT4KCiMjIyMgRGV0YWlscwojIyMjIyBJbXBhY3QKCkNyYWZ0ZWQgcmVxdWVzdHMgdGFyZ2V0aW5nIE5leHQuanMgYXBwbGljYXRpb25zIHVzaW5nIEFwcCBSb3V0ZXIgYnVpbHQgd2l0aCBUdXJib3BhY2sgYW5kIGEgKipzaW5nbGUqKiBlbnRyeSBpbiBgY29uZmlnLmkxOG4ubG9jYWxlc2AgY2FuIGJ5cGFzcyBtaWRkbGV3YXJlL3Byb3h5IGJhc2VkIGF1dGhlbnRpY2F0aW9uLgoKIyMjIyMgV29ya2Fyb3VuZHMKCklmIHlvdSBjYW5ub3QgdXBncmFkZSBpbW1lZGlhdGVseSwgZW5mb3JjZSBhdXRob3JpemF0aW9uIGluIHRoZSBwYWdlJ3Mgc2VydmVyLXNpZGUgZGF0YSBwYXRoIGluc3RlYWQgb2YgcmVseWluZyBzb2xlbHkgb24gbWlkZGxld2FyZS4KCiMjIyMgU2V2ZXJpdHkKLSBDVlNTIFNjb3JlOiA4LjMgLyAxMCAoSGlnaCkKLSBWZWN0b3IgU3RyaW5nOiBgQ1ZTUzo0LjAvQVY6Ti9BQzpML0FUOlAvUFI6Ti9VSTpOL1ZDOkgvVkk6TC9WQTpOL1NDOk4vU0k6Ti9TQTpOYAoKIyMjIyBSZWZlcmVuY2VzCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtNmdwcC14Y2czLTR3MjRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtNmdwcC14Y2czLTR3MjQpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9wdWxsLzk2MDE0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvcHVsbC85NjAxNCkKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL2NvbW1pdC82YmY0ZGYxNDUwOGFkNmMwY2Q0NmFmNTBjNjA1MWVlNDJmMmQ5MTUxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvY29tbWl0LzZiZjRkZjE0NTA4YWQ2YzBjZDQ2YWY1MGM2MDUxZWU0MmYyZDkxNTEpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qc10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzKQotIFtodHRwczovL2dpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvcmVsZWFzZXMvdGFnL3YxNi4yLjExXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvcmVsZWFzZXMvdGFnL3YxNi4yLjExKQoKVGhpcyBkYXRhIGlzIHByb3ZpZGVkIGJ5IFtPU1ZdKGh0dHBzOi8vb3N2LmRldi92dWxuZXJhYmlsaXR5L0dIU0EtNmdwcC14Y2czLTR3MjQpIGFuZCB0aGUgW0dpdEh1YiBBZHZpc29yeSBEYXRhYmFzZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdGh1Yi9hZHZpc29yeS1kYXRhYmFzZSkgKFtDQy1CWSA0LjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRodWIvYWR2aXNvcnktZGF0YWJhc2UvYmxvYi9tYWluL0xJQ0VOU0UubWQpKS4KPC9kZXRhaWxzPgoKLS0tCgojIyMgTmV4dC5qczogU2VydmVyLVNpZGUgUmVxdWVzdCBGb3JnZXJ5IGluIFNlcnZlciBBY3Rpb25zIG9uIGN1c3RvbSBzZXJ2ZXJzCltDVkUtMjAyNi02NDY0OV0oaHR0cHM6Ly9udmQubmlzdC5nb3YvdnVsbi9kZXRhaWwvQ1ZFLTIwMjYtNjQ2NDkpIC8gW0dIU0EtODl4di0ybTU2LTJtOXhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hZHZpc29yaWVzL0dIU0EtODl4di0ybTU2LTJtOXgpCgo8ZGV0YWlscz4KPHN1bW1hcnk+TW9yZSBpbmZvcm1hdGlvbjwvc3VtbWFyeT4KCiMjIyMgRGV0YWlscwojIyMjIyBJbXBhY3QKCldoZW4gYSBTZXJ2ZXIgQWN0aW9uIGZvcndhcmRzIG9yIHJlZGlyZWN0cyBhIHJlcXVlc3QsIGFuIGF0dGFja2VyIGNhbiBjYXVzZSB0aGUgc2VydmVyIHRvIHNlbmQgdGhhdCBvdXRib3VuZCByZXF1ZXN0IHRvIGEgbWFsaWNpb3VzIGhvc3QgKFNlcnZlci1TaWRlIFJlcXVlc3QgRm9yZ2VyeSkuIFRoaXMgcmVxdWlyZXMgdGhlIGF0dGFja2VyJ3MgcmVxdWVzdCB0byBjb250cm9sIEhvc3QtYXNzb2NpYXRlZCBoZWFkZXJzLiBJbiBzb21lIGNvbmZpZ3VyYXRpb25zLCBpdCdzIGFsc28gcG9zc2libGUgdG8gb2J0YWluIGludGVybmFsIHZhbHVlcyB0aGF0IHdlYWtlbiBtaWRkbGV3YXJlL3Byb3h5IGF1dGhvcml6YXRpb24uCgpBcHBsaWNhdGlvbnMgdGhhdCB1c2UgU2VydmVyIEFjdGlvbnMgYXJlIGFmZmVjdGVkIHdoZW4gdGhlIGluY29taW5nIGhvc3QgaGVhZGVyIGlzIG5vdCBmaXhlZCB0byBhIHRydXN0ZWQgdmFsdWUuIFRoaXMgdHlwaWNhbGx5IG9jY3VycyBvbiBjdXN0b20gc2VydmVycywgb3Igb24gZGVwbG95bWVudHMgbm90IGJlaGluZCBhIHByb3h5IHRoYXQgcGlucyB0aGUgaG9zdC4gTWFuYWdlZCBob3N0aW5nIHBpbnMgdGhlIGhvc3QgdXBzdHJlYW0gYW5kIGlzIG5vdCBhZmZlY3RlZDsgYG5leHQgc3RhcnRgIGFuZCBzdGFuZGFsb25lIG91dHB1dCBkbyB0aGUgc2FtZSBmcm9tIHZlcnNpb24gMTQuMiBvbndhcmQuCgojIyMjIyBXb3JrYXJvdW5kcwoKSWYgeW91IGNhbm5vdCB1cGdyYWRlLCBlbnN1cmUgY2xpZW50cyBkbyBub3QgY29udHJvbCB0aGUgaG9zdCBoZWFkZXIgeW91ciBhcHBsaWNhdGlvbiByZWNlaXZlcy4gUGluIG9yIHZhbGlkYXRlIGBIb3N0YCBhbmQgYFgtRm9yd2FyZGVkLUhvc3RgIGF0IHlvdXIgZWRnZSBvciBwcm94eS4gT24gdmVyc2lvbiAxNC4yLjAgYW5kIGxhdGVyLCB5b3UgY2FuIGFkZGl0aW9uYWxseSBzZXQgdGhlIGBfX05FWFRfUFJJVkFURV9PUklHSU5gIGVudmlyb25tZW50IHZhcmlhYmxlIHRvIHlvdXIgZGVwbG95bWVudCdzIHJlYWwgb3JpZ2luOgoKYGBgYmFzaApfX05FWFRfUFJJVkFURV9PUklHSU49aHR0cHM6Ly93d3cuZXhhbXBsZS5jb20gbm9kZSBzZXJ2ZXIuanMKCiMjIyMgU2V2ZXJpdHkKLSBDVlNTIFNjb3JlOiA4LjMgLyAxMCAoSGlnaCkKLSBWZWN0b3IgU3RyaW5nOiBgQ1ZTUzo0LjAvQVY6Ti9BQzpML0FUOlAvUFI6Ti9VSTpOL1ZDOkgvVkk6TC9WQTpOL1NDOk4vU0k6Ti9TQTpOYAoKIyMjIyBSZWZlcmVuY2VzCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtODl4di0ybTU2LTJtOXhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtODl4di0ybTU2LTJtOXgpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9jb21taXQvYjUxMjA2MzIxODU0MTkzMjA4YzA4MDViYTQyYWNjNDkyODdmOTQyYl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL2NvbW1pdC9iNTEyMDYzMjE4NTQxOTMyMDhjMDgwNWJhNDJhY2M0OTI4N2Y5NDJiKQotIFtodHRwczovL2dpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvY29tbWl0L2UzZTU2NjZjY2VhZDNhMTUxNjI3OTNkNjk3YWY1ZTQ4YjdjYzA0OThdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9jb21taXQvZTNlNTY2NmNjZWFkM2ExNTE2Mjc5M2Q2OTdhZjVlNDhiN2NjMDQ5OCkKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9yZWxlYXNlcy90YWcvdjE1LjUuMjFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9yZWxlYXNlcy90YWcvdjE1LjUuMjEpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9yZWxlYXNlcy90YWcvdjE2LjIuMTFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9yZWxlYXNlcy90YWcvdjE2LjIuMTEpCgpUaGlzIGRhdGEgaXMgcHJvdmlkZWQgYnkgW09TVl0oaHR0cHM6Ly9vc3YuZGV2L3Z1bG5lcmFiaWxpdHkvR0hTQS04OXh2LTJtNTYtMm05eCkgYW5kIHRoZSBbR2l0SHViIEFkdmlzb3J5IERhdGFiYXNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0aHViL2Fkdmlzb3J5LWRhdGFiYXNlKSAoW0NDLUJZIDQuMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdGh1Yi9hZHZpc29yeS1kYXRhYmFzZS9ibG9iL21haW4vTElDRU5TRS5tZCkpLgo8L2RldGFpbHM+CgotLS0KCiMjIyBOZXh0LmpzOiBVbmF1dGhlbnRpY2F0ZWQgZGlzY2xvc3VyZSBvZiBpbnRlcm5hbCBTZXJ2ZXIgRnVuY3Rpb24gZW5kcG9pbnRzCltDVkUtMjAyNi02NDY0M10oaHR0cHM6Ly9udmQubmlzdC5nb3YvdnVsbi9kZXRhaWwvQ1ZFLTIwMjYtNjQ2NDMpIC8gW0dIU0EtOTU1cC14M214LWpjdnBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hZHZpc29yaWVzL0dIU0EtOTU1cC14M214LWpjdnApCgo8ZGV0YWlscz4KPHN1bW1hcnk+TW9yZSBpbmZvcm1hdGlvbjwvc3VtbWFyeT4KCiMjIyMgRGV0YWlscwojIyMjIyBJbXBhY3QKCkluIE5leHQuanMgYXBwbGljYXRpb25zIHVzaW5nIEFwcCBSb3V0ZXIsIFNlcnZlciBBY3Rpb25zIChgdXNlIHNlcnZlcmApIG9yIGB1c2UgY2FjaGVgIGVuZHBvaW50cyBjYW4gYmUgZGlzY2xvc2VkIGJ5cGFzc2luZyBhbnkgYXV0aGVudGljYXRpb24gb24gdGhlIHBhZ2VzIHdoZXJlIHRoZXNlIGVuZHBvaW50cyBhcmUgdXN1YWxseSB1c2VkLgoKU2VydmVyIEFjdGlvbiBJRHMgY2FuIGJlIGRpc2Nsb3NlZCB0byB1bmF1dGhlbnRpY2F0ZWQgdXNlcnMgdmlhIHB1YmxpY2x5IHNlcnZlZCBjbGllbnQgYXJ0aWZhY3RzIChmb3IgZXhhbXBsZSwgc3RhdGljIGNodW5rcyBjb250YWluaW5nIGFjdGlvbiByZWZlcmVuY2VzKS4KCkFmZmVjdGVkIHVzZXJzIGFyZSBhcHBsaWNhdGlvbnMgdXNpbmcgQXBwIFJvdXRlciArIFNlcnZlciBBY3Rpb25zLiAgCgpCeSBpdHNlbGYsIHRoaXMgZGlzY2xvc3VyZSBpcyB0eXBpY2FsbHkgYSByZWNvbi9lbnVtZXJhdGlvbiBwcmltaXRpdmU7IGhvd2V2ZXIsIGl0IGNhbiBpbmNyZWFzZSByaXNrIHdoZW4gY29tYmluZWQgd2l0aCBvdGhlciB3ZWFrbmVzc2VzLgogCgojIyMjIyBXb3JrYXJvdW5kcwoKTmV2ZXIgYXNzdW1lIGFueSBhdXRoZW50aWNhdGlvbiBjbGFpbXMgYXQgdGhlIGB1c2UgY2FjaGVgIG9yIGB1c2Ugc2VydmVyYCBib3VuZGFyeS4gQWx3YXlzIGF1dGhlbnRpY2F0ZSB3aXRoaW4gdGhlIGJvdW5kYXJ5LgoKIyMjIyBTZXZlcml0eQotIENWU1MgU2NvcmU6IDYuMyAvIDEwIChNZWRpdW0pCi0gVmVjdG9yIFN0cmluZzogYENWU1M6NC4wL0FWOk4vQUM6TC9BVDpQL1BSOk4vVUk6Ti9WQzpML1ZJOk4vVkE6Ti9TQzpOL1NJOk4vU0E6TmAKCiMjIyMgUmVmZXJlbmNlcwotIFtodHRwczovL2dpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLTk1NXAteDNteC1qY3ZwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLTk1NXAteDNteC1qY3ZwKQotIFtodHRwczovL2dpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvY29tbWl0LzFiMGMzYWU5MTJhM2FkOTI1YzYwMDY1Y2M4ZDU1YjA3MGZhOGJjZDNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9jb21taXQvMWIwYzNhZTkxMmEzYWQ5MjVjNjAwNjVjYzhkNTViMDcwZmE4YmNkMykKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL2NvbW1pdC9mZjEyYTYxMjRlMTUwNGYxN2I2MmRlOTQ4YjhhNTUzZmRlY2FlZjdiXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvY29tbWl0L2ZmMTJhNjEyNGUxNTA0ZjE3YjYyZGU5NDhiOGE1NTNmZGVjYWVmN2IpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qc10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzKQotIFtodHRwczovL2dpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvcmVsZWFzZXMvdGFnL3YxNS41LjIxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvcmVsZWFzZXMvdGFnL3YxNS41LjIxKQotIFtodHRwczovL2dpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvcmVsZWFzZXMvdGFnL3YxNi4yLjExXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvcmVsZWFzZXMvdGFnL3YxNi4yLjExKQoKVGhpcyBkYXRhIGlzIHByb3ZpZGVkIGJ5IFtPU1ZdKGh0dHBzOi8vb3N2LmRldi92dWxuZXJhYmlsaXR5L0dIU0EtOTU1cC14M214LWpjdnApIGFuZCB0aGUgW0dpdEh1YiBBZHZpc29yeSBEYXRhYmFzZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdGh1Yi9hZHZpc29yeS1kYXRhYmFzZSkgKFtDQy1CWSA0LjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRodWIvYWR2aXNvcnktZGF0YWJhc2UvYmxvYi9tYWluL0xJQ0VOU0UubWQpKS4KPC9kZXRhaWxzPgoKLS0tCgojIyMgTmV4dC5qczogRGVuaWFsIG9mIFNlcnZpY2UgaW4gQXBwIFJvdXRlciB1c2luZyBTZXJ2ZXIgQWN0aW9ucwpbQ1ZFLTIwMjYtNjQ2NDFdKGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDI2LTY0NjQxKSAvIFtHSFNBLW05OXcteDdocS03dmZqXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYWR2aXNvcmllcy9HSFNBLW05OXcteDdocS03dmZqKQoKPGRldGFpbHM+CjxzdW1tYXJ5Pk1vcmUgaW5mb3JtYXRpb248L3N1bW1hcnk+CgojIyMjIERldGFpbHMKIyMjIyMgSW1wYWN0CgpDcmFmdGVkIHJlcXVlc3RzIHRhcmdldGluZyBOZXh0LmpzIGFwcGxpY2F0aW9ucyB1c2luZyBBcHAgUm91dGVyIHdpdGggYXQgbGVhc3Qgb25lIFNlcnZlciBBY3Rpb24gY2FuIGxlYWQgdG8gZXhjZXNzaXZlIENQVSB1c2FnZSBibG9ja2luZyBwcm9jZXNzaW5nIG9mIGZ1cnRoZXIgcmVxdWVzdHMgaW4gdGhlIHNhbWUgcHJvY2Vzcy4KCiMjIyMjIFdvcmthcm91bmRzCgpObyB3b3JrYXJvdW5kIGV4aXN0cyBiZXNpZGVzIHVwZ3JhZGluZy4gQXBwbGljYXRpb25zIHVzaW5nIFBhZ2VzIFJvdXRlciBvciBub3QgdXNpbmcgU2VydmVyIEFjdGlvbnMgYXJlIG5vdCB2dWxuZXJhYmxlLgoKIyMjIyBTZXZlcml0eQotIENWU1MgU2NvcmU6IDguMiAvIDEwIChIaWdoKQotIFZlY3RvciBTdHJpbmc6IGBDVlNTOjQuMC9BVjpOL0FDOkwvQVQ6UC9QUjpOL1VJOk4vVkM6Ti9WSTpOL1ZBOkgvU0M6Ti9TSTpOL1NBOk5gCgojIyMjIFJlZmVyZW5jZXMKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS1tOTl3LXg3aHEtN3Zmal0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS1tOTl3LXg3aHEtN3ZmaikKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3B1bGwvOTYwMTNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9wdWxsLzk2MDEzKQotIFtodHRwczovL2dpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvY29tbWl0LzAxOTYyODU3MTY0MWRlYzU3YWFmMzQ5YmEwYzM2MGUzOTY0ZTZmMTJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9jb21taXQvMDE5NjI4NTcxNjQxZGVjNTdhYWYzNDliYTBjMzYwZTM5NjRlNmYxMikKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9yZWxlYXNlcy90YWcvdjE1LjUuMjFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9yZWxlYXNlcy90YWcvdjE1LjUuMjEpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9yZWxlYXNlcy90YWcvdjE2LjIuMTFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9yZWxlYXNlcy90YWcvdjE2LjIuMTEpCgpUaGlzIGRhdGEgaXMgcHJvdmlkZWQgYnkgW09TVl0oaHR0cHM6Ly9vc3YuZGV2L3Z1bG5lcmFiaWxpdHkvR0hTQS1tOTl3LXg3aHEtN3ZmaikgYW5kIHRoZSBbR2l0SHViIEFkdmlzb3J5IERhdGFiYXNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0aHViL2Fkdmlzb3J5LWRhdGFiYXNlKSAoW0NDLUJZIDQuMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdGh1Yi9hZHZpc29yeS1kYXRhYmFzZS9ibG9iL21haW4vTElDRU5TRS5tZCkpLgo8L2RldGFpbHM+CgotLS0KCiMjIyBOZXh0LmpzOiBTZXJ2ZXItU2lkZSBSZXF1ZXN0IEZvcmdlcnkgaW4gcmV3cml0ZXMgdmlhIGF0dGFja2VyLWNvbnRyb2xsZWQgZGVzdGluYXRpb24gaG9zdG5hbWUKW0NWRS0yMDI2LTY0NjQ1XShodHRwczovL252ZC5uaXN0Lmdvdi92dWxuL2RldGFpbC9DVkUtMjAyNi02NDY0NSkgLyBbR0hTQS1wOWoyLWd2OTQtMndmNF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2Fkdmlzb3JpZXMvR0hTQS1wOWoyLWd2OTQtMndmNCkKCjxkZXRhaWxzPgo8c3VtbWFyeT5Nb3JlIGluZm9ybWF0aW9uPC9zdW1tYXJ5PgoKIyMjIyBEZXRhaWxzCiMjIyMjIEltcGFjdAoKQSBgcmV3cml0ZXMoKWAgb3IgYHJlZGlyZWN0cygpYCBydWxlIHRoYXQgYnVpbGRzIGl0cyBleHRlcm5hbCBkZXN0aW5hdGlvbiBob3N0bmFtZSBmcm9tIHJlcXVlc3QtY29udHJvbGxlZCBpbnB1dCBjYW4gYmUgcG9pbnRlZCBhdCBhbiBhcmJpdHJhcnkgaG9zdG5hbWUsIHJlZ2FyZGxlc3Mgb2YgdGhlIHJ1bGUnc8KgaG9zdG5hbWUgc3VmZml4LiBGb3IgYSByZXdyaXRlLCBOZXh0LmpzIHByb3hpZXMgdGhlIHJlcXVlc3QgdG8gdGhhdCBhcmJpdHJhcnkgaG9zdCBhbmQgc2VydmVzIHRoZSByZXNwb25zZSBmcm9tIHRoZSBhcHBsaWNhdGlvbidzIG9yaWdpbiwgbGVhZGluZyB0byBTZXJ2ZXItU2lkZSBSZXF1ZXN0IGZvcmdlcnkuIEEgYHJlZGlyZWN0cygpYCBydWxlIGNvbmZpZ3VyZWQgdGhpcyB3YXkgaXMgdnVsbmVyYWJsZSB0byBhbiBPcGVuIFJlZGlyZWN0LgoKVGhpcyBhZmZlY3RzIGFueSBkZXN0aW5hdGlvbiB0aGF0IHB1dHMgYSBkeW5hbWljIHNlZ21lbnQgaW4gdGhlIGhvc3RuYW1lLCB3aGV0aGVyIGZyb20gdGhlIHBhdGg6CgpgYGBqYXZhc2NyaXB0Ci8vIG5leHQuY29uZmlnLmpzCm1vZHVsZS5leHBvcnRzID0gewogIGFzeW5jIHJld3JpdGVzKCkgewogICAgcmV0dXJuIFsKICAgICAgewogICAgICAgIHNvdXJjZTogJy86dGVuYW50JywKICAgICAgICBkZXN0aW5hdGlvbjogJ2h0dHBzOi8vOnRlbmFudC5hcGkuZXhhbXBsZS5jb20nLAogICAgICB9LAogICAgXQogIH0sCn0KYGBgCgpvciBmcm9tIGEgYGhhc2AgY2FwdHVyZToKCmBgYGphdmFzY3JpcHQKLy8gbmV4dC5jb25maWcuanMKbW9kdWxlLmV4cG9ydHMgPSB7CiAgYXN5bmMgcmV3cml0ZXMoKSB7CiAgICByZXR1cm4gWwogICAgICB7CiAgICAgICAgc291cmNlOiAnLycsCiAgICAgICAgaGFzOiBbeyB0eXBlOiAncXVlcnknLCBrZXk6ICdyZWdpb24nLCB2YWx1ZTogJyg/PHJlZ2lvbj4uKyknIH1dLAogICAgICAgIGRlc3RpbmF0aW9uOiAnaHR0cHM6Ly86cmVnaW9uLmFwaS5leGFtcGxlLmNvbScsCiAgICAgIH0sCiAgICBdCiAgfSwKfQpgYGAKCiMjIyMjIFdvcmthcm91bmRzCgpJZiB5b3UgY2Fubm90IHVwZ3JhZGUgaW1tZWRpYXRlbHksIGRvIG5vdCBidWlsZCB0aGUgaG9zdG5hbWUgb2YgYW4gZXh0ZXJuYWwgYHJld3JpdGVzKClgIG9yIGByZWRpcmVjdHMoKWAgZGVzdGluYXRpb24gZnJvbSB1c2VyLWNvbnRyb2xsZWQgaW5wdXQuIElmIGEgZHluYW1pYyBzdWJkb21haW4gaXMgcmVxdWlyZWQsIGNvbnN0cmFpbiB0aGUgdmFsdWUgdG8gaG9zdG5hbWUtc2FmZSBjaGFyYWN0ZXJzOiAgYHZhbHVlOiAnKD88cmVnaW9uPlthLXowLTktXSspJ2AuCgojIyMjIFNldmVyaXR5Ci0gQ1ZTUyBTY29yZTogOC4zIC8gMTAgKEhpZ2gpCi0gVmVjdG9yIFN0cmluZzogYENWU1M6NC4wL0FWOk4vQUM6TC9BVDpQL1BSOk4vVUk6Ti9WQzpIL1ZJOkwvVkE6Ti9TQzpML1NJOkwvU0E6TmAKCiMjIyMgUmVmZXJlbmNlcwotIFtodHRwczovL2dpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLXA5ajItZ3Y5NC0yd2Y0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLXA5ajItZ3Y5NC0yd2Y0KQotIFtodHRwczovL2dpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvY29tbWl0LzM1ZjUwMTM1N2U5YjBmZTdjOTUwYjBkNmFhOGZjZjUzNDNmNzA3ZTldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9jb21taXQvMzVmNTAxMzU3ZTliMGZlN2M5NTBiMGQ2YWE4ZmNmNTM0M2Y3MDdlOSkKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL2NvbW1pdC9kMzAzMzI2NmM2ZGZmMjNmN2JlNzFlMTkzNDFmZTNhOGM2ZTJjNTk5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvY29tbWl0L2QzMDMzMjY2YzZkZmYyM2Y3YmU3MWUxOTM0MWZlM2E4YzZlMmM1OTkpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qc10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzKQotIFtodHRwczovL2dpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvcmVsZWFzZXMvdGFnL3YxNS41LjIxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvcmVsZWFzZXMvdGFnL3YxNS41LjIxKQotIFtodHRwczovL2dpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvcmVsZWFzZXMvdGFnL3YxNi4yLjExXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvcmVsZWFzZXMvdGFnL3YxNi4yLjExKQoKVGhpcyBkYXRhIGlzIHByb3ZpZGVkIGJ5IFtPU1ZdKGh0dHBzOi8vb3N2LmRldi92dWxuZXJhYmlsaXR5L0dIU0EtcDlqMi1ndjk0LTJ3ZjQpIGFuZCB0aGUgW0dpdEh1YiBBZHZpc29yeSBEYXRhYmFzZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdGh1Yi9hZHZpc29yeS1kYXRhYmFzZSkgKFtDQy1CWSA0LjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRodWIvYWR2aXNvcnktZGF0YWJhc2UvYmxvYi9tYWluL0xJQ0VOU0UubWQpKS4KPC9kZXRhaWxzPgoKLS0tCgojIyMgTmV4dC5qczogRGVuaWFsIG9mIFNlcnZpY2UgaW4gdGhlIEltYWdlIE9wdGltaXphdGlvbiBBUEkgdXNpbmcgU1ZHcwpbQ1ZFLTIwMjYtNjQ2NDRdKGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDI2LTY0NjQ0KSAvIFtHSFNBLXE4d2YtNnI4Zy02M2NoXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYWR2aXNvcmllcy9HSFNBLXE4d2YtNnI4Zy02M2NoKQoKPGRldGFpbHM+CjxzdW1tYXJ5Pk1vcmUgaW5mb3JtYXRpb248L3N1bW1hcnk+CgojIyMjIERldGFpbHMKIyMjIyMgSW1wYWN0CgpXaGVuIHNlbGYtaG9zdGluZyBOZXh0LmpzIHdpdGggdGhlIGRlZmF1bHQgaW1hZ2UgbG9hZGVyLCB0aGUgSW1hZ2UgT3B0aW1pemF0aW9uIEFQSSBjYW4gb3B0aW1pemUgcmVtb3RlbHkgaG9zdGVkIGltYWdlcyBpZiBjb25maWd1cmVkIChub3QgZW5hYmxlZCBieSBkZWZhdWx0KS4gSWYgdGhvc2UgaW1hZ2VzIGNvbnRhaW4gbWFsaWNpb3VzIGNvbnRlbnQsIHRoZXkgY2FuIGNhdXNlIENQVSBleGhhdXN0aW9uIGluICBgL19uZXh0L2ltYWdlYCBlbmRwb2ludHMuCgotIElmIHlvdSBhcmUgdXNpbmcgYGNvbmZpZy5pbWFnZXMucmVtb3RlUGF0dGVybnNgLCBvbmx5IHRoZSBwYXR0ZXJucyBpbiB0aGF0IGFycmF5IGFyZSBpbXBhY3RlZC4KLSBJZiB5b3UgYXJlIHVzaW5nIGBjb25maWcuaW1hZ2VzLnVub3B0aW1pemVkOiB0cnVlYCwgeW91IGFyZSBOT1QgaW1wYWN0ZWQuCi0gSWYgeW91IGFyZSB1c2luZyBgY29uZmlnLmltYWdlcy5sb2FkZXI6ICdjdXN0b20nYCwgeW91IGFyZSBOT1QgaW1wYWN0ZWQuCi0gSWYgeW91IGFyZSB1c2luZyBWZXJjZWwsIHlvdSBhcmUgTk9UIGltcGFjdGVkLgoKIyMjIyMgV29ya2Fyb3VuZHMKCklmIHlvdSBjYW5ub3QgdXBncmFkZSBpbW1lZGlhdGVseSwgeW91IGNhbiBhdm9pZCB0aGUgZXhwZW5zaXZlIHdvcmsgYnkgc2V0dGluZyBgY29uZmlnLmV4cGVyaW1lbnRhbC5pbWdPcHRTa2lwTWV0YWRhdGEgOiB0cnVlYC4KCiMjIyMgU2V2ZXJpdHkKLSBDVlNTIFNjb3JlOiA2LjMgLyAxMCAoTWVkaXVtKQotIFZlY3RvciBTdHJpbmc6IGBDVlNTOjQuMC9BVjpOL0FDOkwvQVQ6UC9QUjpOL1VJOk4vVkM6Ti9WSTpOL1ZBOkwvU0M6Ti9TSTpOL1NBOk5gCgojIyMjIFJlZmVyZW5jZXMKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS1xOHdmLTZyOGctNjNjaF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS1xOHdmLTZyOGctNjNjaCkKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzL3B1bGwvOTYwMDZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9wdWxsLzk2MDA2KQotIFtodHRwczovL2dpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvY29tbWl0LzkzY2I5MDg5MTQwMmZhNGM0Nzc5OGQwM2NiOWUwNWMxMzIzMzc2NmNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9jb21taXQvOTNjYjkwODkxNDAyZmE0YzQ3Nzk4ZDAzY2I5ZTA1YzEzMjMzNzY2YykKLSBbaHR0cHM6Ly9naXRodWIuY29tL3ZlcmNlbC9uZXh0LmpzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9yZWxlYXNlcy90YWcvdjE1LjUuMjFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9yZWxlYXNlcy90YWcvdjE1LjUuMjEpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9yZWxlYXNlcy90YWcvdjE2LjIuMTFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS92ZXJjZWwvbmV4dC5qcy9yZWxlYXNlcy90YWcvdjE2LjIuMTEpCgpUaGlzIGRhdGEgaXMgcHJvdmlkZWQgYnkgW09TVl0oaHR0cHM6Ly9vc3YuZGV2L3Z1bG5lcmFiaWxpdHkvR0hTQS1xOHdmLTZyOGctNjNjaCkgYW5kIHRoZSBbR2l0SHViIEFkdmlzb3J5IERhdGFiYXNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0aHViL2Fkdmlzb3J5LWRhdGFiYXNlKSAoW0NDLUJZIDQuMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdGh1Yi9hZHZpc29yeS1kYXRhYmFzZS9ibG9iL21haW4vTElDRU5TRS5tZCkpLgo8L2RldGFpbHM+CgotLS0KCiMjIyBSZWxlYXNlIE5vdGVzCgo8ZGV0YWlscz4KPHN1bW1hcnk+dmVyY2VsL25leHQuanMgKG5leHQpPC9zdW1tYXJ5PgoKIyMjIFtgdjE2LjIuMTFgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvY29tcGFyZS92MTYuMi4xMC4uLnYxNi4yLjExKQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vdmVyY2VsL25leHQuanMvY29tcGFyZS92MTYuMi4xMC4uLnYxNi4yLjExKQoKPC9kZXRhaWxzPgoKLS0tCgojIyMgQ29uZmlndXJhdGlvbgoK8J+ThSAqKlNjaGVkdWxlKio6IChVVEMpCgotIEJyYW5jaCBjcmVhdGlvbgogIC0gQXQgYW55IHRpbWUgKG5vIHNjaGVkdWxlIGRlZmluZWQpCi0gQXV0b21lcmdlCiAgLSBBdCBhbnkgdGltZSAobm8gc2NoZWR1bGUgZGVmaW5lZCkKCvCfmqYgKipBdXRvbWVyZ2UqKjogRGlzYWJsZWQgYnkgY29uZmlnLiBQbGVhc2UgbWVyZ2UgdGhpcyBtYW51YWxseSBvbmNlIHlvdSBhcmUgc2F0aXNmaWVkLgoK4pm7ICoqUmViYXNpbmcqKjogV2hlbmV2ZXIgUFIgYmVjb21lcyBjb25mbGljdGVkLCBvciB5b3UgdGljayB0aGUgcmViYXNlL3JldHJ5IGNoZWNrYm94LgoK8J+UlSAqKklnbm9yZSoqOiBDbG9zZSB0aGlzIFBSIGFuZCB5b3Ugd29uJ3QgYmUgcmVtaW5kZWQgYWJvdXQgdGhpcyB1cGRhdGUgYWdhaW4uCgotLS0KCiAtIFsgXSA8IS0tIHJlYmFzZS1jaGVjayAtLT5JZiB5b3Ugd2FudCB0byByZWJhc2UvcmV0cnkgdGhpcyBQUiwgY2hlY2sgdGhpcyBib3gKCi0tLQoKVGhpcyBQUiB3YXMgZ2VuZXJhdGVkIGJ5IFtNZW5kIFJlbm92YXRlXShodHRwczovL21lbmQuaW8vcmVub3ZhdGUvKS4gVmlldyB0aGUgW3JlcG9zaXRvcnkgam9iIGxvZ10oaHR0cHM6Ly9kZXZlbG9wZXIubWVuZC5pby9naXRodWIvb3Npc20vcHl0aG9uLW9zaXNtKS4KPCEtLXJlbm92YXRlLWRlYnVnOmV5SmpjbVZoZEdWa1NXNVdaWElpT2lJME15NHlOelV1TWlJc0luVndaR0YwWldSSmJsWmxjaUk2SWpRekxqSTNOUzR5SWl3aWRHRnlaMlYwUW5KaGJtTm9Jam9pYldGcGJpSXNJbXhoWW1Wc2N5STZXeUp5Wlc1dmRtRjBaU0pkZlE9PS0tPgo=
      patchset: 198f264c96655fe2c1029802caad50251383d36f
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/flake8/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/python-osism
        name: osism/python-osism
        short_name: python-osism
        src_dir: src/github.com/osism/python-osism
      projects:
        github.com/osism/python-osism:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          checkout: main
          checkout_description: zuul branch
          commit: 21ed88f923e09ac5a2c22667dd103852333aea81
          name: osism/python-osism
          required: false
          short_name: python-osism
          src_dir: src/github.com/osism/python-osism
      ref: refs/pull/2505/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
