From e3afb8cc69a21906df80f6f96218ad5e2b8ed8eb Mon Sep 17 00:00:00 2001 From: Lourens de Jager <165963988+lourens-octopus@users.noreply.github.com> Date: Tue, 28 Jul 2026 10:37:15 +1200 Subject: [PATCH] fix(deps): resolve new brace-expansion and js-yaml advisories New advisories supersede the earlier fixes: - brace-expansion GHSA-mh99-v99m-4gvg flags all <=5.0.7; only 5.0.8 is patched and no fixed 1.x/2.x exists, so an overrides entry forces ^5.0.8 (expand() API is stable). Bundled glob copy -> dist rebuilt. - js-yaml -> 5.2.2 (advisory now covers 5.0.0-5.2.1). npm audit reports 0 vulnerabilities. Co-Authored-By: Claude Opus 4.8 (1M context) --- dist/index.js | 301 +++++++++++++++++++++++++++------------------- package-lock.json | 81 +++---------- package.json | 7 +- 3 files changed, 198 insertions(+), 191 deletions(-) diff --git a/dist/index.js b/dist/index.js index e9636103..53773ab4 100644 --- a/dist/index.js +++ b/dist/index.js @@ -23029,33 +23029,34 @@ var require_path = __commonJS({ } }); -// node_modules/balanced-match/index.js -var require_balanced_match = __commonJS({ - "node_modules/balanced-match/index.js"(exports2, module2) { - "use strict"; - module2.exports = balanced; - function balanced(a, b, str) { - if (a instanceof RegExp) a = maybeMatch(a, str); - if (b instanceof RegExp) b = maybeMatch(b, str); - var r = range(a, b, str); +// node_modules/balanced-match/dist/commonjs/index.js +var require_commonjs = __commonJS({ + "node_modules/balanced-match/dist/commonjs/index.js"(exports2) { + "use strict"; + Object.defineProperty(exports2, "__esModule", { value: true }); + exports2.range = exports2.balanced = void 0; + var balanced = (a, b, str) => { + const ma = a instanceof RegExp ? maybeMatch(a, str) : a; + const mb = b instanceof RegExp ? maybeMatch(b, str) : b; + const r = ma !== null && mb != null && (0, exports2.range)(ma, mb, str); return r && { start: r[0], end: r[1], pre: str.slice(0, r[0]), - body: str.slice(r[0] + a.length, r[1]), - post: str.slice(r[1] + b.length) + body: str.slice(r[0] + ma.length, r[1]), + post: str.slice(r[1] + mb.length) }; - } - function maybeMatch(reg, str) { - var m = str.match(reg); + }; + exports2.balanced = balanced; + var maybeMatch = (reg, str) => { + const m = str.match(reg); return m ? m[0] : null; - } - balanced.range = range; - function range(a, b, str) { - var begs, beg, left, right, result; - var ai = str.indexOf(a); - var bi = str.indexOf(b, ai + 1); - var i = ai; + }; + var range = (a, b, str) => { + let begs, beg, left, right = void 0, result; + let ai = str.indexOf(a); + let bi = str.indexOf(b, ai + 1); + let i = ai; if (ai >= 0 && bi > 0) { if (a === b) { return [ai, bi]; @@ -23063,14 +23064,16 @@ var require_balanced_match = __commonJS({ begs = []; left = str.length; while (i >= 0 && !result) { - if (i == ai) { + if (i === ai) { begs.push(i); ai = str.indexOf(a, i + 1); - } else if (begs.length == 1) { - result = [begs.pop(), bi]; + } else if (begs.length === 1) { + const r = begs.pop(); + if (r !== void 0) + result = [r, bi]; } else { beg = begs.pop(); - if (beg < left) { + if (beg !== void 0 && beg < left) { left = beg; right = bi; } @@ -23078,63 +23081,80 @@ var require_balanced_match = __commonJS({ } i = ai < bi && ai >= 0 ? ai : bi; } - if (begs.length) { + if (begs.length && right !== void 0) { result = [left, right]; } } return result; - } + }; + exports2.range = range; } }); -// node_modules/glob/node_modules/brace-expansion/index.js -var require_brace_expansion = __commonJS({ - "node_modules/glob/node_modules/brace-expansion/index.js"(exports2, module2) { - var balanced = require_balanced_match(); - module2.exports = expandTop; +// node_modules/brace-expansion/dist/commonjs/index.js +var require_commonjs2 = __commonJS({ + "node_modules/brace-expansion/dist/commonjs/index.js"(exports2) { + "use strict"; + Object.defineProperty(exports2, "__esModule", { value: true }); + exports2.EXPANSION_MAX_LENGTH = exports2.EXPANSION_MAX = void 0; + exports2.expand = expand; + var balanced_match_1 = require_commonjs(); var escSlash = "\0SLASH" + Math.random() + "\0"; var escOpen = "\0OPEN" + Math.random() + "\0"; var escClose = "\0CLOSE" + Math.random() + "\0"; var escComma = "\0COMMA" + Math.random() + "\0"; var escPeriod = "\0PERIOD" + Math.random() + "\0"; + var escSlashPattern = new RegExp(escSlash, "g"); + var escOpenPattern = new RegExp(escOpen, "g"); + var escClosePattern = new RegExp(escClose, "g"); + var escCommaPattern = new RegExp(escComma, "g"); + var escPeriodPattern = new RegExp(escPeriod, "g"); + var slashPattern = /\\\\/g; + var openPattern = /\\{/g; + var closePattern = /\\}/g; + var commaPattern = /\\,/g; + var periodPattern = /\\\./g; + exports2.EXPANSION_MAX = 1e5; + exports2.EXPANSION_MAX_LENGTH = 4e6; function numeric(str) { - return parseInt(str, 10) == str ? parseInt(str, 10) : str.charCodeAt(0); + return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0); } function escapeBraces(str) { - return str.split("\\\\").join(escSlash).split("\\{").join(escOpen).split("\\}").join(escClose).split("\\,").join(escComma).split("\\.").join(escPeriod); + return str.replace(slashPattern, escSlash).replace(openPattern, escOpen).replace(closePattern, escClose).replace(commaPattern, escComma).replace(periodPattern, escPeriod); } function unescapeBraces(str) { - return str.split(escSlash).join("\\").split(escOpen).join("{").split(escClose).join("}").split(escComma).join(",").split(escPeriod).join("."); + return str.replace(escSlashPattern, "\\").replace(escOpenPattern, "{").replace(escClosePattern, "}").replace(escCommaPattern, ",").replace(escPeriodPattern, "."); } function parseCommaParts(str) { - if (!str) + if (!str) { return [""]; - var parts = []; - var m = balanced("{", "}", str); - if (!m) + } + const parts = []; + const m = (0, balanced_match_1.balanced)("{", "}", str); + if (!m) { return str.split(","); - var pre = m.pre; - var body = m.body; - var post = m.post; - var p = pre.split(","); + } + const { pre, body, post } = m; + const p = pre.split(","); p[p.length - 1] += "{" + body + "}"; - var postParts = parseCommaParts(post); + const postParts = parseCommaParts(post); if (post.length) { + ; p[p.length - 1] += postParts.shift(); p.push.apply(p, postParts); } parts.push.apply(parts, p); return parts; } - function expandTop(str, options) { - if (!str) + function expand(str, options = {}) { + if (!str) { return []; - options = options || {}; - var max = options.max == null ? Infinity : options.max; - if (str.substr(0, 2) === "{}") { - str = "\\{\\}" + str.substr(2); } - return expand(escapeBraces(str), max, true).map(unescapeBraces); + const { max = exports2.EXPANSION_MAX, maxLength = exports2.EXPANSION_MAX_LENGTH } = options; + if (str.slice(0, 2) === "{}") { + str = "\\{\\}" + str.slice(2); + } + return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces); } function embrace(str) { return "{" + str + "}"; @@ -23148,97 +23168,126 @@ var require_brace_expansion = __commonJS({ function gte(i, y) { return i >= y; } - function expand(str, max, isTop) { - var expansions = []; + function combine(acc, pre, values, max, maxLength, dropEmpties) { + const out = []; + let length = 0; + for (let a = 0; a < acc.length; a++) { + for (let v = 0; v < values.length; v++) { + if (out.length >= max) + return out; + const expansion = acc[a] + pre + values[v]; + if (dropEmpties && !expansion) + continue; + if (length + expansion.length > maxLength) + return out; + out.push(expansion); + length += expansion.length; + } + } + return out; + } + function expandSequence(body, isAlphaSequence, max) { + const n = body.split(/\.\./); + const N = []; + if (n[0] === void 0 || n[1] === void 0) { + return N; + } + const x = numeric(n[0]); + const y = numeric(n[1]); + const width = Math.max(n[0].length, n[1].length); + let incr = n.length === 3 && n[2] !== void 0 ? Math.max(Math.abs(numeric(n[2])), 1) : 1; + let test = lte; + const reverse = y < x; + if (reverse) { + incr *= -1; + test = gte; + } + const pad = n.some(isPadded); + for (let i = x; test(i, y) && N.length < max; i += incr) { + let c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === "\\") { + c = ""; + } + } else { + c = String(i); + if (pad) { + const need = width - c.length; + if (need > 0) { + const z = new Array(need + 1).join("0"); + if (i < 0) { + c = "-" + z + c.slice(1); + } else { + c = z + c; + } + } + } + } + N.push(c); + } + return N; + } + function expand_(str, max, maxLength, isTop) { + let acc = [""]; + let dropEmpties = false; + let firstGroup = true; for (; ; ) { - const m = balanced("{", "}", str); - if (!m) return [str]; + const m = (0, balanced_match_1.balanced)("{", "}", str); + if (!m) { + return combine(acc, str, [""], max, maxLength, dropEmpties); + } const pre = m.pre; - if (/\$$/.test(m.pre)) { - const post2 = m.post.length ? expand(m.post, max, false) : [""]; - for (let k2 = 0; k2 < post2.length && k2 < max; k2++) { - const expansion2 = pre + "{" + m.body + "}" + post2[k2]; - expansions.push(expansion2); - } - return expansions; - } - var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); - var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); - var isSequence = isNumericSequence || isAlphaSequence; - var isOptions = m.body.indexOf(",") >= 0; + if (/\$$/.test(pre)) { + acc = combine(acc, pre + "{" + m.body + "}", [""], max, maxLength, dropEmpties && !m.post.length); + firstGroup = false; + if (!m.post.length) + break; + str = m.post; + continue; + } + const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); + const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); + const isSequence = isNumericSequence || isAlphaSequence; + const isOptions = m.body.indexOf(",") >= 0; if (!isSequence && !isOptions) { if (m.post.match(/,(?!,).*\}/)) { str = m.pre + "{" + m.body + escClose + m.post; isTop = true; continue; } - return [str]; + return combine(acc, pre + "{" + m.body + "}" + m.post, [""], max, maxLength, dropEmpties); + } + if (firstGroup) { + dropEmpties = isTop && !isSequence; + firstGroup = false; } - const post = m.post.length ? expand(m.post, max, false) : [""]; - var n; + let values; if (isSequence) { - n = m.body.split(/\.\./); + values = expandSequence(m.body, isAlphaSequence, max); } else { - n = parseCommaParts(m.body); - if (n.length === 1) { - n = expand(n[0], max, false).map(embrace); + let n = parseCommaParts(m.body); + if (n.length === 1 && n[0] !== void 0) { + n = expand_(n[0], max, maxLength, false).map(embrace); if (n.length === 1) { - return post.map(function(p) { - return m.pre + n[0] + p; - }); - } - } - } - var N; - if (isSequence) { - var x = numeric(n[0]); - var y = numeric(n[1]); - var width = Math.max(n[0].length, n[1].length); - var incr = n.length == 3 ? Math.max(Math.abs(numeric(n[2])), 1) : 1; - var test = lte; - var reverse = y < x; - if (reverse) { - incr *= -1; - test = gte; - } - var pad = n.some(isPadded); - N = []; - for (var i = x; test(i, y) && N.length < max; i += incr) { - var c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === "\\") - c = ""; - } else { - c = String(i); - if (pad) { - var need = width - c.length; - if (need > 0) { - var z = new Array(need + 1).join("0"); - if (i < 0) - c = "-" + z + c.slice(1); - else - c = z + c; - } - } + acc = combine(acc, pre + n[0], [""], max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) + break; + str = m.post; + continue; } - N.push(c); - } - } else { - N = []; - for (var j = 0; j < n.length; j++) { - N.push.apply(N, expand(n[j], max, false)); } - } - for (var j = 0; j < N.length; j++) { - for (var k = 0; k < post.length && expansions.length < max; k++) { - var expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) - expansions.push(expansion); + values = []; + for (let j = 0; j < n.length; j++) { + values.push.apply(values, expand_(n[j], max, maxLength, false)); } } - return expansions; + acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) + break; + str = m.post; } + return acc; } } }); @@ -23258,7 +23307,7 @@ var require_minimatch = __commonJS({ minimatch.sep = path.sep; var GLOBSTAR = Symbol("globstar **"); minimatch.GLOBSTAR = GLOBSTAR; - var expand = require_brace_expansion(); + var expand = require_commonjs2(); var plTypes = { "!": { open: "(?:(?!(?:", close: "))[^/]*?)" }, "?": { open: "(?:", close: ")?" }, diff --git a/package-lock.json b/package-lock.json index 445d4bd0..1099945c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -33,7 +33,7 @@ "jest": "29.7.0", "jest-circus": "29.7.0", "jest-junit": "17.0.0", - "js-yaml": "5.2.1", + "js-yaml": "5.2.2", "prettier": "3.8.3", "ts-jest": "29.4.9", "typescript": "5.9.3" @@ -2301,29 +2301,6 @@ "url": "https://opencollective.com/typescript-eslint" } }, - "node_modules/@typescript-eslint/typescript-estree/node_modules/balanced-match": { - "version": "4.0.4", - "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", - "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", - "dev": true, - "license": "MIT", - "engines": { - "node": "18 || 20 || >=22" - } - }, - "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "5.0.8", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", - "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^4.0.2" - }, - "engines": { - "node": "20 || >=22" - } - }, "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": { "version": "10.2.5", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz", @@ -2891,10 +2868,13 @@ } }, "node_modules/balanced-match": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", - "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", - "license": "MIT" + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", + "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", + "license": "MIT", + "engines": { + "node": "18 || 20 || >=22" + } }, "node_modules/baseline-browser-mapping": { "version": "2.9.5", @@ -2907,14 +2887,15 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", - "dev": true, + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "license": "MIT", "dependencies": { - "balanced-match": "^1.0.0", - "concat-map": "0.0.1" + "balanced-match": "^4.0.2" + }, + "engines": { + "node": "20 || >=22" } }, "node_modules/braces": { @@ -3200,13 +3181,6 @@ "node": ">= 0.8" } }, - "node_modules/concat-map": { - "version": "0.0.1", - "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz", - "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==", - "dev": true, - "license": "MIT" - }, "node_modules/convert-source-map": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz", @@ -4631,15 +4605,6 @@ "node": ">=10.13.0" } }, - "node_modules/glob/node_modules/brace-expansion": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", - "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0" - } - }, "node_modules/glob/node_modules/minimatch": { "version": "5.1.9", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz", @@ -6115,9 +6080,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "5.2.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.1.tgz", - "integrity": "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==", + "version": "5.2.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.2.tgz", + "integrity": "sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==", "dev": true, "funding": [ { @@ -8252,16 +8217,6 @@ "url": "https://opencollective.com/typescript-eslint" } }, - "node_modules/typescript-eslint/node_modules/brace-expansion": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", - "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0" - } - }, "node_modules/typescript-eslint/node_modules/ignore": { "version": "7.0.5", "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz", diff --git a/package.json b/package.json index f52713d0..6862be56 100644 --- a/package.json +++ b/package.json @@ -29,7 +29,7 @@ "jest": "29.7.0", "jest-circus": "29.7.0", "jest-junit": "17.0.0", - "js-yaml": "5.2.1", + "js-yaml": "5.2.2", "prettier": "3.8.3", "ts-jest": "29.4.9", "typescript": "5.9.3" @@ -98,5 +98,8 @@ "test:unit": "node --experimental-vm-modules node_modules/jest/bin/jest.js --ci --reporters=default --reporters=jest-junit --testPathPattern=__tests__/unit", "test:integration": "node --experimental-vm-modules node_modules/jest/bin/jest.js --ci --reporters=default --reporters=jest-junit --testPathPattern=__tests__/integration" }, - "version": "4.2.1" + "version": "4.2.1", + "overrides": { + "brace-expansion": "^5.0.8" + } }