deps updates v11 jun29

node_modules/brace-expansion/dist/commonjs/index.js

@@ -95,19 +95,23 @@ function gte(i, y) {
 function expand_(str, max, isTop) {
     /** @type {string[]} */
     const expansions = [];
-    const m = (0, balanced_match_1.balanced)('{', '}', str);
-    if (!m)
-        return [str];
-    // no need to expand pre, since it is guaranteed to be free of brace-sets
-    const pre = m.pre;
-    const post = m.post.length ? expand_(m.post, max, false) : [''];
-    if (/\$$/.test(m.pre)) {
-        for (let k = 0; k < post.length && k < max; k++) {
-            const expansion = pre + '{' + m.body + '}' + post[k];
-            expansions.push(expansion);
+    // The `{a},b}` rewrite below restarts expansion on a rewritten string with
+    // the same `max` and `isTop = true`. Loop instead of recursing so a long run
+    // of non-expanding `{}` groups can't exhaust the call stack.
+    for (;;) {
+        const m = (0, balanced_match_1.balanced)('{', '}', str);
+        if (!m)
+            return [str];
+        // no need to expand pre, since it is guaranteed to be free of brace-sets
+        const pre = m.pre;
+        if (/\$$/.test(m.pre)) {
+            const post = m.post.length ? expand_(m.post, max, false) : [''];
+            for (let k = 0; k < post.length && k < max; k++) {
+                const expansion = pre + '{' + m.body + '}' + post[k];
+                expansions.push(expansion);
+            }
+            return expansions;
         }
-    }
-    else {
         const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
         const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
         const isSequence = isNumericSequence || isAlphaSequence;
@@ -116,10 +120,16 @@ function expand_(str, max, isTop) {
             // {a},b}
             if (m.post.match(/,(?!,).*\}/)) {
                 str = m.pre + '{' + m.body + escClose + m.post;
-                return expand_(str, max, true);
+                isTop = true;
+                continue;
             }
             return [str];
         }
+        // Only expand post once we know this brace set actually expands. Computing
+        // it before the early returns above expanded post a second time on every
+        // non-expanding `{}`, which is what made inputs like `a{},{},{}...` blow up
+        // exponentially.
+        const post = m.post.length ? expand_(m.post, max, false) : [''];
         let n;
         if (isSequence) {
             n = m.body.split(/\.\./);
@@ -195,7 +205,7 @@ function expand_(str, max, isTop) {
                 }
             }
         }
+        return expansions;
     }
-    return expansions;
 }
 //# sourceMappingURL=index.js.map

node_modules/brace-expansion/dist/esm/index.js

@@ -91,19 +91,23 @@ function gte(i, y) {
 function expand_(str, max, isTop) {
     /** @type {string[]} */
     const expansions = [];
-    const m = balanced('{', '}', str);
-    if (!m)
-        return [str];
-    // no need to expand pre, since it is guaranteed to be free of brace-sets
-    const pre = m.pre;
-    const post = m.post.length ? expand_(m.post, max, false) : [''];
-    if (/\$$/.test(m.pre)) {
-        for (let k = 0; k < post.length && k < max; k++) {
-            const expansion = pre + '{' + m.body + '}' + post[k];
-            expansions.push(expansion);
+    // The `{a},b}` rewrite below restarts expansion on a rewritten string with
+    // the same `max` and `isTop = true`. Loop instead of recursing so a long run
+    // of non-expanding `{}` groups can't exhaust the call stack.
+    for (;;) {
+        const m = balanced('{', '}', str);
+        if (!m)
+            return [str];
+        // no need to expand pre, since it is guaranteed to be free of brace-sets
+        const pre = m.pre;
+        if (/\$$/.test(m.pre)) {
+            const post = m.post.length ? expand_(m.post, max, false) : [''];
+            for (let k = 0; k < post.length && k < max; k++) {
+                const expansion = pre + '{' + m.body + '}' + post[k];
+                expansions.push(expansion);
+            }
+            return expansions;
         }
-    }
-    else {
         const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
         const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
         const isSequence = isNumericSequence || isAlphaSequence;
@@ -112,10 +116,16 @@ function expand_(str, max, isTop) {
             // {a},b}
             if (m.post.match(/,(?!,).*\}/)) {
                 str = m.pre + '{' + m.body + escClose + m.post;
-                return expand_(str, max, true);
+                isTop = true;
+                continue;
             }
             return [str];
         }
+        // Only expand post once we know this brace set actually expands. Computing
+        // it before the early returns above expanded post a second time on every
+        // non-expanding `{}`, which is what made inputs like `a{},{},{}...` blow up
+        // exponentially.
+        const post = m.post.length ? expand_(m.post, max, false) : [''];
         let n;
         if (isSequence) {
             n = m.body.split(/\.\./);
@@ -191,7 +201,7 @@ function expand_(str, max, isTop) {
                 }
             }
         }
+        return expansions;
     }
-    return expansions;
 }
 //# sourceMappingURL=index.js.map

node_modules/brace-expansion/package.json

@@ -1,7 +1,7 @@
 {
   "name": "brace-expansion",
   "description": "Brace expansion as known from sh/bash",
-  "version": "5.0.6",
+  "version": "5.0.7",
   "files": [
     "dist"
   ],
@@ -59,6 +59,6 @@
   "module": "./dist/esm/index.js",
   "repository": {
     "type": "git",
-    "url": "git+ssh://git@github.com/juliangruber/brace-expansion.git"
+    "url": "git+https://github.com/juliangruber/brace-expansion.git"
   }
 }

node_modules/semver/classes/range.js

@@ -299,17 +299,21 @@ const replaceTildes = (comp, options) => {
 
 const replaceTilde = (comp, options) => {
   const r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE]
+  // if we're including prereleases in the match, then the lower bound is
+  // -0, the lowest possible prerelease value, just like x-ranges and carets.
+  // this keeps `~1.2` equivalent to the `1.2.x` x-range it's documented as.
+  const z = options.includePrerelease ? '-0' : ''
   return comp.replace(r, (_, M, m, p, pr) => {
     debug('tilde', comp, _, M, m, p, pr)
     let ret
 
     if (isX(M)) {
       ret = ''
     } else if (isX(m)) {
-      ret = `>=${M}.0.0 <${+M + 1}.0.0-0`
+      ret = `>=${M}.0.0${z} <${+M + 1}.0.0-0`
     } else if (isX(p)) {
       // ~1.2 == >=1.2.0 <1.3.0-0
-      ret = `>=${M}.${m}.0 <${M}.${+m + 1}.0-0`
+      ret = `>=${M}.${m}.0${z} <${M}.${+m + 1}.0-0`
     } else if (pr) {
       debug('replaceTilde pr', pr)
       ret = `>=${M}.${m}.${p}-${pr

node_modules/semver/package.json

@@ -1,6 +1,6 @@
 {
   "name": "semver",
-  "version": "7.8.4",
+  "version": "7.8.5",
   "description": "The semantic version parser used by npm.",
   "main": "index.js",
   "scripts": {

node_modules/tar/dist/commonjs/header.js

@@ -41,6 +41,7 @@ exports.Header = void 0;
 const node_path_1 = require("node:path");
 const large = __importStar(require("./large-numbers.js"));
 const types = __importStar(require("./types.js"));
+const notNegative = (n) => n === undefined || n < 0 ? undefined : n;
 class Header {
     cksumValid = false;
     needPax = false;
@@ -99,10 +100,9 @@ class Header {
             exForFields?.uid ?? gexForFields?.uid ?? decNumber(buf, off + 108, 8);
         this.gid =
             exForFields?.gid ?? gexForFields?.gid ?? decNumber(buf, off + 116, 8);
-        this.size =
-            exForFields?.size ??
-                gexForFields?.size ??
-                decNumber(buf, off + 124, 12);
+        this.size = notNegative(exForFields?.size ??
+            gexForFields?.size ??
+            decNumber(buf, off + 124, 12));
         this.mtime =
             exForFields?.mtime ??
                 gexForFields?.mtime ??
@@ -188,6 +188,7 @@ class Header {
             // null/undefined values are ignored.
             return !(v === null ||
                 v === undefined ||
+                (k === 'size' && Number(v) < 0) ||
                 (k === 'path' && gex) ||
                 (k === 'linkpath' && gex) ||
                 k === 'global');

node_modules/tar/dist/commonjs/normalize-windows-path.js

@@ -7,6 +7,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizeWindowsPath = void 0;
 const platform = process.env.TESTING_TAR_FAKE_PLATFORM || process.platform;
 exports.normalizeWindowsPath = platform !== 'win32' ?
-    (p) => p
-    : (p) => p && p.replaceAll(/\\/g, '/');
+    (p) => String(p)
+    : (p) => String(p).replaceAll(/\\/g, '/');
 //# sourceMappingURL=normalize-windows-path.js.map

node_modules/tar/dist/commonjs/parse.js

@@ -60,6 +60,10 @@ const SAW_VALID_ENTRY = Symbol('sawValidEntry');
 const SAW_NULL_BLOCK = Symbol('sawNullBlock');
 const SAW_EOF = Symbol('sawEOF');
 const CLOSESTREAM = Symbol('closeStream');
+const MAX_DECOMPRESSION_RATIO = 1000;
+const COMPRESSEDBYTESREAD = Symbol('compressedBytesRead');
+const DECOMPRESSEDBYTESREAD = Symbol('decompressedBytesRead');
+const CHECKDECOMPRESSIONRATIO = Symbol('checkDecompressionRatio');
 const noop = () => true;
 class Parser extends events_1.EventEmitter {
     file;
@@ -68,6 +72,7 @@ class Parser extends events_1.EventEmitter {
     filter;
     brotli;
     zstd;
+    maxDecompressionRatio;
     writable = true;
     readable = false;
     [QUEUE] = [];
@@ -87,6 +92,8 @@ class Parser extends events_1.EventEmitter {
     [WRITING] = false;
     [CONSUMING] = false;
     [EMITTEDEND] = false;
+    [COMPRESSEDBYTESREAD] = 0;
+    [DECOMPRESSEDBYTESREAD] = 0;
     constructor(opt = {}) {
         super();
         this.file = opt.file || '';
@@ -109,6 +116,10 @@ class Parser extends events_1.EventEmitter {
             });
         }
         this.strict = !!opt.strict;
+        this.maxDecompressionRatio =
+            typeof opt.maxDecompressionRatio === 'number' ?
+                opt.maxDecompressionRatio
+                : MAX_DECOMPRESSION_RATIO;
         this.maxMetaEntrySize = opt.maxMetaEntrySize || maxMetaEntrySize;
         this.filter = typeof opt.filter === 'function' ? opt.filter : noop;
         // Unlike gzip, brotli doesn't have any magic bytes to identify it
@@ -362,11 +373,23 @@ class Parser extends events_1.EventEmitter {
         }
     }
     abort(error) {
+        if (this[ABORTED]) {
+            return;
+        }
         this[ABORTED] = true;
         this.emit('abort', error);
         // always throws, even in non-strict mode
         this.warn('TAR_ABORT', error, { recoverable: false });
     }
+    [CHECKDECOMPRESSIONRATIO](chunk) {
+        this[DECOMPRESSEDBYTESREAD] += chunk.length;
+        const ratio = this[DECOMPRESSEDBYTESREAD] / this[COMPRESSEDBYTESREAD];
+        if (ratio > this.maxDecompressionRatio) {
+            this.abort(new Error(`max decompression ratio exceeded: ${ratio.toFixed(2)} > ${this.maxDecompressionRatio}`));
+            return false;
+        }
+        return true;
+    }
     write(chunk, encoding, cb) {
         if (typeof encoding === 'function') {
             cb = encoding;
@@ -450,13 +473,22 @@ class Parser extends events_1.EventEmitter {
                     this[UNZIP] === undefined ? new minizlib_1.Unzip({})
                         : isZstd ? new minizlib_1.ZstdDecompress({})
                             : new minizlib_1.BrotliDecompress({});
-                this[UNZIP].on('data', chunk => this[CONSUMECHUNK](chunk));
-                this[UNZIP].on('error', er => this.abort(er));
+                this[UNZIP].on('data', chunk => {
+                    if (this[CHECKDECOMPRESSIONRATIO](chunk)) {
+                        this[CONSUMECHUNK](chunk);
+                    }
+                });
+                this[UNZIP].on('error', er => {
+                    if (!this[ABORTED]) {
+                        this.abort(er);
+                    }
+                });
                 this[UNZIP].on('end', () => {
                     this[ENDED] = true;
                     this[CONSUMECHUNK]();
                 });
                 this[WRITING] = true;
+                this[COMPRESSEDBYTESREAD] += chunk.length;
                 const ret = !!this[UNZIP][ended ? 'end' : 'write'](chunk);
                 this[WRITING] = false;
                 cb?.();
@@ -465,6 +497,7 @@ class Parser extends events_1.EventEmitter {
         }
         this[WRITING] = true;
         if (this[UNZIP]) {
+            this[COMPRESSEDBYTESREAD] += chunk.length;
             this[UNZIP].write(chunk);
         }
         else {
@@ -495,7 +528,7 @@ class Parser extends events_1.EventEmitter {
             !this[CONSUMING]) {
             this[EMITTEDEND] = true;
             const entry = this[WRITEENTRY];
-            if (entry && entry.blockRemain) {
+            if (entry?.blockRemain) {
                 // truncated, likely a damaged file
                 const have = this[BUFFER] ? this[BUFFER].length : 0;
                 this.warn('TAR_BAD_ARCHIVE', `Truncated input (needed ${entry.blockRemain} more bytes, only ${have} available)`, { entry });
@@ -589,8 +622,10 @@ class Parser extends events_1.EventEmitter {
         if (!this[ABORTED]) {
             if (this[UNZIP]) {
                 /* c8 ignore start */
-                if (chunk)
+                if (chunk) {
+                    this[COMPRESSEDBYTESREAD] += chunk.length;
                     this[UNZIP].write(chunk);
+                }
                 /* c8 ignore stop */
                 this[UNZIP].end();
             }

node_modules/tar/dist/commonjs/pax.js

@@ -147,12 +147,36 @@ const parseKVLine = (set, line) => {
         return set;
     }
     const k = r.replace(/^SCHILY\.(dev|ino|nlink)/, '$1');
-    const v = kv.join('=');
-    set[k] =
-        /^([A-Z]+\.)?([mac]|birth|creation)time$/.test(k) ?
-            new Date(Number(v) * 1000)
-            : /^[0-9]+$/.test(v) ? +v
-                : v;
+    const v = kv.join('=').replace(/\0.*/, '');
+    switch (k) {
+        case 'path':
+        case 'linkpath':
+        case 'type':
+        case 'charset':
+        case 'comment':
+        case 'gname':
+        case 'uname':
+            set[k] = v;
+            break;
+        case 'ctime':
+        case 'atime':
+        case 'mtime':
+            set[k] = new Date(Number(v) * 1000);
+            break;
+        case 'size':
+            const s = +v;
+            if (s >= 0)
+                set[k] = s;
+            break;
+        case 'gid':
+        case 'uid':
+        case 'dev':
+        case 'ino':
+        case 'nlink':
+        case 'mode':
+            set[k] = +v;
+            break;
+    }
     return set;
 };
 //# sourceMappingURL=pax.js.map

node_modules/tar/dist/commonjs/unpack.js

@@ -185,7 +185,7 @@ class Unpack extends parse_js_1.Parser {
         // default true for root
         this.preserveOwner =
             opt.preserveOwner === undefined && typeof opt.uid !== 'number' ?
-                !!(process.getuid && process.getuid() === 0)
+                !!(process.getuid?.() === 0)
                 : !!opt.preserveOwner;
         this.processUid =
             (this.preserveOwner || this.setOwner) && process.getuid ?
@@ -406,7 +406,7 @@ class Unpack extends parse_js_1.Parser {
         }
     }
     [MKDIR](dir, mode, cb) {
-        (0, mkdir_js_1.mkdir)((0, normalize_windows_path_js_1.normalizeWindowsPath)(dir), {
+        void (0, mkdir_js_1.mkdir)((0, normalize_windows_path_js_1.normalizeWindowsPath)(dir), {
             uid: this.uid,
             gid: this.gid,
             processUid: this.processUid,