diff --git a/dist/index.js b/dist/index.js index 124c262..010df74 100644 --- a/dist/index.js +++ b/dist/index.js @@ -15870,7 +15870,7 @@ function requireFollowRedirects () { return followRedirects.exports; } -/*! Axios v1.18.1 Copyright (c) 2026 Matt Zabriskie and contributors */ +/*! Axios v1.19.0 Copyright (c) 2026 Matt Zabriskie and contributors */ var axios_1; var hasRequiredAxios; @@ -16173,6 +16173,7 @@ function requireAxios () { * @returns {boolean} True if value is a FileList, otherwise false */ const isFileList = kindOfTest('FileList'); + const isSet = kindOfTest('Set'); /** * Determine if a value is a Stream @@ -16695,11 +16696,20 @@ function requireAxios () { if (!('toJSON' in source)) { // add-on descent / delete-on-ascent: preserves path semantics, so DAG nodes serialise at every occurrence (see #7230). visited.add(source); - const target = isArray(source) ? [] : {}; - forEach(source, (value, key) => { - const reducedValue = visit(value); - !isUndefined(reducedValue) && (target[key] = reducedValue); - }); + let target; + if (isSet(source)) { + target = []; + for (const value of source) { + const reducedValue = visit(value); + !isUndefined(reducedValue) && target.push(reducedValue); + } + } else { + target = isArray(source) ? [] : {}; + forEach(source, (value, key) => { + const reducedValue = visit(value); + !isUndefined(reducedValue) && (target[key] = reducedValue); + }); + } visited.delete(source); return target; } @@ -16873,17 +16883,18 @@ function requireAxios () { i = line.indexOf(':'); key = line.substring(0, i).trim().toLowerCase(); val = line.substring(i + 1).trim(); - if (!key || parsed[key] && ignoreDuplicateOf[key]) { + const hasKey = utils$1.hasOwnProp(parsed, key); + if (!key || hasKey && utils$1.hasOwnProp(ignoreDuplicateOf, key)) { return; } if (key === 'set-cookie') { - if (parsed[key]) { + if (hasKey) { parsed[key].push(val); } else { parsed[key] = [val]; } } else { - parsed[key] = parsed[key] ? parsed[key] + ', ' + val : val; + parsed[key] = hasKey ? parsed[key] + ', ' + val : val; } }); return parsed; @@ -16949,6 +16960,90 @@ function requireAxios () { } return tokens; } + const parameterNameRE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/; + function trimOWS(value) { + let start = 0; + let end = value.length; + while (start < end) { + const code = value.charCodeAt(start); + if (code !== 0x09 && code !== 0x20) { + break; + } + start += 1; + } + while (end > start) { + const code = value.charCodeAt(end - 1); + if (code !== 0x09 && code !== 0x20) { + break; + } + end -= 1; + } + return start === 0 && end === value.length ? value : value.slice(start, end); + } + function decodeQuotedString(value) { + const last = value.length - 1; + if (last < 1 || value.charCodeAt(0) !== 0x22 || value.charCodeAt(last) !== 0x22) { + return value; + } + let decoded = ''; + for (let i = 1; i < last; i++) { + const code = value.charCodeAt(i); + if (code === 0x22) { + return value; + } + if (code === 0x5c) { + i += 1; + if (i >= last) { + return value; + } + } + decoded += value[i]; + } + return decoded; + } + function parseParameters(value) { + const parameters = Object.create(null); + const str = String(value); + let start = 0; + let quoted = false; + let escaped = false; + function parseParameter(end) { + const part = trimOWS(str.slice(start, end)); + const equals = part.indexOf('='); + if (equals < 1) { + return; + } + const name = trimOWS(part.slice(0, equals)); + if (!parameterNameRE.test(name)) { + return; + } + const normalizedName = name.toLowerCase(); + if (normalizedName === '__proto__' || normalizedName === 'constructor' || normalizedName === 'prototype') { + return; + } + const parameterValue = trimOWS(part.slice(equals + 1)); + parameters[normalizedName] = decodeQuotedString(parameterValue); + } + for (let i = 0; i < str.length; i++) { + const code = str.charCodeAt(i); + if (quoted) { + if (escaped) { + escaped = false; + } else if (code === 0x5c) { + escaped = true; + } else if (code === 0x22) { + quoted = false; + } + } else if (code === 0x22) { + quoted = true; + } else if (code === 0x2c || code === 0x3b) { + parseParameter(i); + start = i + 1; + } + } + parseParameter(str.length); + return parameters; + } const isValidHeaderName = str => /^[-_a-zA-Z0-9^`|~,!#$%&'*+.]+$/.test(str.trim()); function matchHeaderValue(context, value, header, filter, isHeaderNameFilter) { if (utils$1.isFunction(filter)) { @@ -17126,7 +17221,8 @@ function requireAxios () { return Object.entries(this.toJSON()).map(([header, value]) => header + ': ' + value).join('\n'); } getSetCookie() { - return this.get('set-cookie') || []; + const value = this.get('set-cookie'); + return utils$1.isArray(value) ? value : value == null || value === false ? [] : [value]; } get [Symbol.toStringTag]() { return 'AxiosHeaders'; @@ -17134,6 +17230,9 @@ function requireAxios () { static from(thing) { return thing instanceof this ? thing : new this(thing); } + static parseParameters(value) { + return parseParameters(value); + } static concat(first, ...targets) { const computed = new this(first); targets.forEach(target => computed.set(target)); @@ -17228,9 +17327,33 @@ function requireAxios () { }; return visit(config); } + function stringifySafely$1(value) { + try { + return String(value); + } catch (err) { + return ''; + } + } + function aggregateErrorMessage(error) { + const message = error.errors.map(entry => { + try { + return entry && entry.message ? stringifySafely$1(entry.message) : stringifySafely$1(entry); + } catch (err) { + return ''; + } + }).filter(Boolean).join('; '); + return message || error.name || 'AggregateError'; + } class AxiosError extends Error { static from(error, code, config, request, response, customProps) { - const axiosError = new AxiosError(error.message, code || error.code, config, request, response); + // `AggregateError` (thrown by Node on dual-stack/Happy-Eyeballs connection + // failures) has an empty `message`; its detail lives in `errors[]`. Without + // this, the wrapped error surfaces with a blank message (see #6721). + let message = error.message; + if (!message && utils$1.isArray(error.errors) && error.errors.length) { + message = aggregateErrorMessage(error); + } + const axiosError = new AxiosError(message, code || error.code, config, request, response); // Match native `Error` `cause` semantics: non-enumerable. The wrapped // error often carries circular internals (sockets, requests, agents), so // an enumerable `cause` makes structured loggers (pino/winston) and any @@ -17334,6 +17457,15 @@ function requireAxios () { AxiosError.ERR_INVALID_URL = 'ERR_INVALID_URL'; AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED = 'ERR_FORM_DATA_DEPTH_EXCEEDED'; + var PlatformBuffer = { + isBufferAvailable() { + return typeof Buffer !== 'undefined'; + }, + from(value) { + return Buffer.from(value); + } + }; + // Default nesting limit shared with the inverse transform (formDataToJSON) so // the FormData <-> JSON round-trip stays symmetric. const DEFAULT_FORM_DATA_MAX_DEPTH = 100; @@ -17459,8 +17591,8 @@ function requireAxios () { if (useBlob && typeof _Blob === 'function') { return new _Blob([value]); } - if (typeof Buffer !== 'undefined') { - return Buffer.from(value); + if (PlatformBuffer && PlatformBuffer.isBufferAvailable()) { + return PlatformBuffer.from(value); } throw new AxiosError('Blob is not supported. Use a Buffer instead.', AxiosError.ERR_NOT_SUPPORT); } @@ -17840,12 +17972,18 @@ function requireAxios () { * @returns An array of strings. */ function parsePropPath(name) { - // foo[x][y][z] - // foo.x.y.z - // foo-x-y-z - // foo x y z + // foo[x][y][z] -> ['foo', 'x', 'y', 'z'] + // foo.x.y.z -> ['foo', 'x', 'y', 'z'] + // A path is split on `.` and on `[...]` groups. A segment — whether written + // in dot notation or captured inside brackets — may contain any character + // except `.`, `[` and `]`, so a key like `user-name` or `user name` is kept + // literal instead of being split (#5402). `.`, `[` and `]` keep their existing + // meaning, e.g. `foo[bar.baz]` -> ['foo', 'bar', 'baz'] and `[]` is an array push. + // Excluding `[` from the bracket group also makes the match fail fast at the + // next `[`, so a malformed name cannot rescan to the end of the string from + // every unmatched `[` — parsing stays linear in the length of the name. const path = []; - const pattern = /\w+|\[(\w*)]/g; + const pattern = /[^.[\]]+|\[([^.[\]]*)]/g; let match; while ((match = pattern.exec(name)) !== null) { throwIfDepthExceeded(path.length); @@ -18121,7 +18259,14 @@ function requireAxios () { * @returns {string} The combined URL */ function combineURLs(baseURL, relativeURL) { - return relativeURL ? baseURL.replace(/\/?\/$/, '') + '/' + relativeURL.replace(/^\/+/, '') : baseURL; + if (!relativeURL) { + return baseURL; + } + let end = baseURL.length; + while (end > 0 && baseURL.charCodeAt(end - 1) === 47) { + end--; + } + return baseURL.slice(0, end) + '/' + relativeURL.replace(/^\/+/, ''); } const malformedHttpProtocol = /^https?:(?!\/\/)/i; @@ -18136,9 +18281,39 @@ function requireAxios () { function normalizeURLForProtocolCheck(url) { return stripLeadingC0ControlOrSpace(url).replace(httpProtocolControlCharacters, ''); } + + // Redact the parts of a URL that can carry secrets before it is embedded in an + // error message. AxiosError.toJSON() serializes `message` verbatim and errors + // are commonly logged, while the opt-in `config.redact` model only cleans + // config keys — it cannot reach the message. Redact only the genuinely + // sensitive substrings — userinfo (credentials), query parameter values and + // fragment contents — with the same REDACTED marker the config redaction uses, + // while keeping the scheme, host, path and parameter names so the offending + // request stays accurately identifiable. + function redactFragment(fragment) { + if (!fragment) { + return fragment; + } + return fragment.replace(/(^|&)([^=&]*=)?[^&]+/g, (match, separator, parameterName = '') => { + return `${separator}${parameterName}${REDACTED}`; + }); + } + function redactSensitiveURLParts(url) { + const redactedURL = url.replace(/^(https?:\/{0,2})[^/?#]*@/i, `$1${REDACTED}@`); + const fragmentIndex = redactedURL.indexOf('#'); + const urlWithoutFragment = fragmentIndex === -1 ? redactedURL : redactedURL.slice(0, fragmentIndex); + const redactedURLWithoutFragment = urlWithoutFragment.replace(/([?&][^=&#]*=)[^&#]*/g, `$1${REDACTED}`); + if (fragmentIndex === -1) { + return redactedURLWithoutFragment; + } + return `${redactedURLWithoutFragment}#${redactFragment(redactedURL.slice(fragmentIndex + 1))}`; + } function assertValidHttpProtocolURL(url, config) { - if (typeof url === 'string' && malformedHttpProtocol.test(normalizeURLForProtocolCheck(url))) { - throw new AxiosError('Invalid URL: missing "//" after protocol', AxiosError.ERR_INVALID_URL, config); + if (typeof url === 'string') { + const normalizedURL = normalizeURLForProtocolCheck(url); + if (malformedHttpProtocol.test(normalizedURL)) { + throw new AxiosError(`Invalid URL ${JSON.stringify(redactSensitiveURLParts(normalizedURL))}: missing "//" after protocol`, AxiosError.ERR_INVALID_URL, config); + } } } @@ -18258,7 +18433,7 @@ function requireAxios () { return process.env[key.toLowerCase()] || process.env[key.toUpperCase()] || ''; } - const VERSION = "1.18.1"; + const VERSION = "1.19.0"; function parseProtocol(url) { const match = /^([-+\w]{1,25}):(?:\/\/)?/.exec(url); @@ -18318,6 +18493,31 @@ function requireAxios () { throw new AxiosError('Unsupported protocol ' + protocol, AxiosError.ERR_NOT_SUPPORT); } + const FORM_DATA_CONTENT_HEADERS = ['content-type', 'content-length']; + + /** + * Apply the headers generated by a FormData implementation to the request headers, + * honoring the `formDataHeaderPolicy` option: with 'content-only', copy only the + * content-* headers; otherwise merge all of them. + * + * @param {AxiosHeaders} headers - the request headers to mutate + * @param {Object | null | undefined} formHeaders - headers produced by the FormData implementation + * @param {String} [policy] - the resolved `formDataHeaderPolicy` config value + * + * @returns {void} + */ + function setFormDataHeaders(headers, formHeaders, policy) { + if (policy !== 'content-only') { + headers.set(formHeaders); + return; + } + Object.entries(formHeaders || {}).forEach(([key, val]) => { + if (FORM_DATA_CONTENT_HEADERS.includes(key.toLowerCase())) { + headers.set(key, val); + } + }); + } + const kInternals = Symbol('internals'); class AxiosTransformStream extends stream.Transform { constructor(options) { @@ -18648,6 +18848,104 @@ function requireAxios () { if (parts[0] !== '127') return false; return parts.every(p => /^\d+$/.test(p) && Number(p) >= 0 && Number(p) <= 255); }; + + /** + * Canonicalize an IPv4 address written in shorthand, octal, or hex form into + * dotted-decimal. IPv6 addresses and non-IP strings are returned unchanged so + * the existing IPv4-mapped IPv6 unmap path and the isLoopback path can still + * see them. + * + * Shorthand expansion mirrors Node's URL parser: literal parts fill from the + * left, the final part fills the remaining octets from the right with + * zero-padding on the left. + * 127.1 -> 127.0.0.1 + * 127.0.1 -> 127.0.0.1 + * 1.2.3 -> 1.2.0.3 + * + * Each octet is parsed with an explicit base: 16 for `0x`/`0X` prefix, 8 for + * zero-prefixed multi-digit all-`0-7` parts, 10 otherwise. Zero-prefixed + * decimal-looking parts that contain `8` or `9` are rejected to match Node's + * URL parser, and the comparison layer falls through to non-bypass if either + * side rejects the form (fail-safe). + * + * Returns the input unchanged on any parse failure, out-of-range octet, or + * unusual shape (1-part, 5+ parts) so the comparison layer fails closed. + */ + const parseIPv4Octet = text => { + if (/^0[xX][0-9a-fA-F]+$/.test(text)) { + const n = parseInt(text.slice(2), 16); + return Number.isFinite(n) ? n : null; + } + if (text.length > 1 && /^0[0-7]+$/.test(text)) { + const n = parseInt(text, 8); + return Number.isFinite(n) ? n : null; + } + if (text.length > 1 && /^0[0-9]+$/.test(text)) { + return null; + } + if (/^[0-9]+$/.test(text)) { + const n = parseInt(text, 10); + return Number.isFinite(n) ? n : null; + } + return null; + }; + const normalizeIPAddress = host => { + if (typeof host !== 'string' || !host || host.indexOf(':') !== -1) { + return host; + } + let h = host; + if (h.charAt(0) === '[' && h.charAt(h.length - 1) === ']') { + h = h.slice(1, -1); + } + h = h.replace(/\.+$/, ''); + + // Allowed characters for any IPv4 shape: digits, dot, 'x', 'X', hex digits. + if (!/^[0-9.xXa-fA-F]+$/.test(h)) return host; + const parts = h.split('.'); + + // No part may be empty (e.g. "127..0.1" or "127.0.0."). Trailing dots are + // already stripped above; this guards against the empty-middle case. + if (parts.some(p => p === '')) return host; + if (parts.length === 4) { + // Full IPv4 form: each part is an octet. + const octets = parts.map(parseIPv4Octet); + if (octets.some(n => n === null || n < 0 || n > 255)) return host; + return octets.join('.'); + } + if (parts.length > 4) { + return host; + } + + // Shorthand: 1..3 parts. Node's URL parser treats a 1-part input as a 32-bit + // integer split into octets, which has surprising semantics (e.g. "127" -> + // "0.0.0.127"). Reject 1-part inputs to keep the helper predictable: the + // fail-safe returns the input unchanged and the comparison layer falls + // through to non-bypass. + if (parts.length === 1) return host; + + // 2..3 parts: literal parts fill from the left, tail fills remaining octets + // from the right with zero-padding. + const literalOctets = parts.slice(0, -1); + const tail = parts[parts.length - 1]; + const tailSlots = 4 - literalOctets.length; + + // Tail is parsed as a full IPv4 number (hex/octal/decimal) and packed + // low-byte-right into the remaining octets, matching Node's URL parser. + // e.g. 127.65535 (tail 0xFFFF into 3 slots) -> 127.0.255.255; + // 127.0x00ff (tail 0xFF into 3 slots) -> 127.0.0.255; + // 127.0.65535 (tail 0xFFFF into 2 slots) -> 127.0.255.255. + const tailValue = parseIPv4Octet(tail); + if (tailValue === null) return host; + const maxTail = (1 << 8 * tailSlots) - 1; + if (tailValue < 0 || tailValue > maxTail) return host; + const tailOctets = new Array(tailSlots).fill(0); + for (let i = tailSlots - 1, v = tailValue; i >= 0; i--, v >>= 8) { + tailOctets[i] = v & 0xff; + } + const literal = literalOctets.map(parseIPv4Octet); + if (literal.some(n => n === null || n < 0 || n > 255)) return host; + return [...literal, ...tailOctets].join('.'); + }; const isIPv6ZeroGroup = group => /^0{1,4}$/.test(group); // The unspecified address (IPv4 0.0.0.0 / IPv6 ::) resolves to the local host @@ -18761,7 +19059,15 @@ function requireAxios () { if (hostname.charAt(0) === '[' && hostname.charAt(hostname.length - 1) === ']') { hostname = hostname.slice(1, -1); } - return unmapIPv4MappedIPv6(hostname.replace(/\.+$/, '')); + const trimmed = hostname.replace(/\.+$/, ''); + + // IPv4 shorthand/octal/hex → dotted-decimal; helper is a no-op for inputs + // containing ':' (IPv6 and IPv4-mapped IPv6) so we fall through to unmap. + const ipv4 = normalizeIPAddress(trimmed); + if (ipv4 !== trimmed) { + return ipv4; + } + return unmapIPv4MappedIPv6(trimmed); }; function shouldBypassProxy(location) { let parsed; @@ -18783,6 +19089,9 @@ function requireAxios () { if (!entry) { return false; } + if (entry === '*') { + return true; + } let [entryHost, entryPort] = parseNoProxyEntry(entry); entryHost = normalizeNoProxyHost(entryHost); if (!entryHost) { @@ -18889,7 +19198,7 @@ function requireAxios () { } const rawLoaded = e.loaded; const total = e.lengthComputable ? e.total : undefined; - const loaded = total != null ? Math.min(rawLoaded, total) : rawLoaded; + const loaded = Math.max(0, total != null ? Math.min(rawLoaded, total) : rawLoaded); const progressBytes = Math.max(0, loaded - bytesNotified); const rate = _speedometer(progressBytes); bytesNotified = Math.max(bytesNotified, loaded); @@ -18915,20 +19224,85 @@ function requireAxios () { loaded }), throttled[1]]; }; - const asyncDecorator = fn => (...args) => utils$1.asap(() => fn(...args)); + const asyncDecorator = (fn, scheduler = utils$1.asap) => (...args) => scheduler(() => fn(...args)); /** - * Estimate decoded byte length of a data:// URL *without* allocating large buffers. - * - For base64: compute exact decoded size using length and padding; - * handle %XX at the character-count level (no string allocation). - * - For non-base64: compute the exact percent-decoded UTF-8 byte length. - * - * @param {string} url - * @returns {number} + * Estimate data: URL byte lengths *without* allocating large buffers. + * - Fetch percent-decodes a base64 body before decoding it. + * - Node's Buffer.from(body, 'base64') sizes its backing allocation from the + * raw body, including ignored characters and content after padding. + * - Non-base64 data is percent-decoded and then encoded as UTF-8. */ const isHexDigit = charCode => charCode >= 48 && charCode <= 57 || charCode >= 65 && charCode <= 70 || charCode >= 97 && charCode <= 102; const isPercentEncodedByte = (str, i, len) => i + 2 < len && isHexDigit(str.charCodeAt(i + 1)) && isHexDigit(str.charCodeAt(i + 2)); - function estimateDataURLDecodedBytes(url) { + const hexValue = charCode => charCode <= 57 ? charCode - 48 : (charCode & 0xdf) - 55; + const isBase64Char = charCode => charCode >= 65 && charCode <= 90 || + // A-Z + charCode >= 97 && charCode <= 122 || + // a-z + charCode >= 48 && charCode <= 57 || + // 0-9 + charCode === 43 || + // + + charCode === 47 || + // / + charCode === 45 || + // - (base64url) + charCode === 95; // _ (base64url) + + const isBase64Whitespace = charCode => charCode === 9 || charCode === 10 || charCode === 12 || charCode === 13 || charCode === 32; + const base64Bytes = significant => { + const groups = Math.floor(significant / 4); + const remainder = significant % 4; + return groups * 3 + (remainder === 2 ? 1 : remainder === 3 ? 2 : 0); + }; + + // Buffer.byteLength(body, 'base64') uses the raw string length as an allocation + // upper bound even when Buffer.from later ignores characters or stops at '='. + const estimateBase64BufferAllocation = body => { + const len = body.length; + let padding = 0; + if (len > 0 && body.charCodeAt(len - 1) === 61 /* '=' */) { + padding++; + if (len > 1 && body.charCodeAt(len - 2) === 61 /* '=' */) { + padding++; + } + } + return Math.floor((len - padding) * 3 / 4); + }; + const estimatePercentDecodedBase64Bytes = body => { + const len = body.length; + let significant = 0; + let padding = 0; + let invalid = false; + for (let i = 0; i < len; i++) { + let code = body.charCodeAt(i); + if (code === 37 /* '%' */ && isPercentEncodedByte(body, i, len)) { + code = hexValue(body.charCodeAt(i + 1)) * 16 + hexValue(body.charCodeAt(i + 2)); + i += 2; + } + if (isBase64Whitespace(code)) { + continue; + } + if (code === 61 /* '=' */) { + padding++; + continue; + } + if (!isBase64Char(code) || padding > 0) { + invalid = true; + continue; + } + significant++; + } + + // Fetch rejects malformed forgiving-base64 input. Returning the raw-size + // allocation bound keeps that invalid input from becoming a pre-check bypass. + if (invalid || padding > 2 || padding > 0 && (significant + padding) % 4 !== 0 || significant % 4 === 1) { + return estimateBase64BufferAllocation(body); + } + return base64Bytes(significant); + }; + const estimateDataURLBytes = (url, estimateBase64) => { if (!url || typeof url !== 'string') return 0; if (!url.startsWith('data:')) return 0; const comma = url.indexOf(','); @@ -18937,47 +19311,7 @@ function requireAxios () { const body = url.slice(comma + 1); const isBase64 = /;base64/i.test(meta); if (isBase64) { - let effectiveLen = body.length; - const len = body.length; // cache length - - for (let i = 0; i < len; i++) { - if (body.charCodeAt(i) === 37 /* '%' */ && i + 2 < len) { - const a = body.charCodeAt(i + 1); - const b = body.charCodeAt(i + 2); - const isHex = isHexDigit(a) && isHexDigit(b); - if (isHex) { - effectiveLen -= 2; - i += 2; - } - } - } - let pad = 0; - let idx = len - 1; - const tailIsPct3D = j => j >= 2 && body.charCodeAt(j - 2) === 37 && - // '%' - body.charCodeAt(j - 1) === 51 && ( - // '3' - body.charCodeAt(j) === 68 || body.charCodeAt(j) === 100); // 'D' or 'd' - - if (idx >= 0) { - if (body.charCodeAt(idx) === 61 /* '=' */) { - pad++; - idx--; - } else if (tailIsPct3D(idx)) { - pad++; - idx -= 3; - } - } - if (pad === 1 && idx >= 0) { - if (body.charCodeAt(idx) === 61 /* '=' */) { - pad++; - } else if (tailIsPct3D(idx)) { - pad++; - } - } - const groups = Math.floor(effectiveLen / 4); - const bytes = groups * 3 - (pad || 0); - return bytes > 0 ? bytes : 0; + return estimateBase64(body); } // Compute UTF-8 byte length directly from UTF-16 code units without allocating @@ -19007,6 +19341,28 @@ function requireAxios () { } } return bytes; + }; + + /** + * Estimate the percent-decoded payload size used by Fetch data: URLs. + * + * @param {string} url + * @returns {number} + */ + function estimateDataURLDecodedBytes(url) { + // Fetch removes URL fragments before processing a data: URL. + const fragmentIndex = typeof url === 'string' ? url.indexOf('#') : -1; + return estimateDataURLBytes(fragmentIndex === -1 ? url : url.slice(0, fragmentIndex), estimatePercentDecodedBase64Bytes); + } + + /** + * Estimate the Buffer backing allocation used by Node's raw base64 decoder. + * + * @param {string} url + * @returns {number} + */ + function estimateDataURLBufferAllocation(url) { + return estimateDataURLBytes(url, estimateBase64BufferAllocation); } const zlibOptions = { @@ -19025,23 +19381,12 @@ function requireAxios () { const isZstdSupported = utils$1.isFunction(zlib.createZstdDecompress); const ACCEPT_ENCODING = 'gzip, compress, deflate' + (isBrotliSupported ? ', br' : ''); const ACCEPT_ENCODING_WITH_ZSTD = ACCEPT_ENCODING + (isZstdSupported ? ', zstd' : ''); + const scheduleProgress = typeof process !== 'undefined' && process.nextTick ? process.nextTick.bind(process) : utils$1.asap; const { http: httpFollow, https: httpsFollow } = followRedirects; const isHttps = /https:?/; - const FORM_DATA_CONTENT_HEADERS$1 = ['content-type', 'content-length']; - function setFormDataHeaders$1(headers, formHeaders, policy) { - if (policy !== 'content-only') { - headers.set(formHeaders); - return; - } - Object.entries(formHeaders).forEach(([key, val]) => { - if (FORM_DATA_CONTENT_HEADERS$1.includes(key.toLowerCase())) { - headers.set(key, val); - } - }); - } // Symbols used to bind a single 'error' listener to a pooled socket and track // the request currently owning that socket across keep-alive reuse (issue #10780). @@ -19541,7 +19886,7 @@ function requireAxios () { if (maxContentLength > -1) { // Use the exact string passed to fromDataURI (the configured url); fall back to fullPath if needed. const dataUrl = String(own('url') || fullPath || ''); - const estimated = estimateDataURLDecodedBytes(dataUrl); + const estimated = estimateDataURLBufferAllocation(dataUrl); if (estimated > maxContentLength) { return reject(new AxiosError('maxContentLength size of ' + maxContentLength + ' exceeded', AxiosError.ERR_BAD_RESPONSE, config)); } @@ -19607,7 +19952,7 @@ function requireAxios () { }); // support for https://www.npmjs.com/package/form-data api } else if (utils$1.isFormData(data) && utils$1.isFunction(data.getHeaders) && data.getHeaders !== Object.prototype.getHeaders) { - setFormDataHeaders$1(headers, data.getHeaders(), own('formDataHeaderPolicy')); + setFormDataHeaders(headers, data.getHeaders(), own('formDataHeaderPolicy')); if (!headers.hasContentLength()) { try { const knownLength = await util.promisify(data.getLength).call(data); @@ -19650,7 +19995,7 @@ function requireAxios () { data = stream.pipeline([data, new AxiosTransformStream({ maxRate: utils$1.toFiniteNumber(maxUploadRate) })], utils$1.noop); - onUploadProgress && data.on('progress', flushOnFinish(data, progressEventDecorator(contentLength, progressEventReducer(asyncDecorator(onUploadProgress), false, 3)))); + onUploadProgress && data.on('progress', flushOnFinish(data, progressEventDecorator(contentLength, progressEventReducer(asyncDecorator(onUploadProgress, scheduleProgress), false, 3)))); } // HTTP basic authentication @@ -19815,7 +20160,7 @@ function requireAxios () { const transformStream = new AxiosTransformStream({ maxRate: utils$1.toFiniteNumber(maxDownloadRate) }); - onDownloadProgress && transformStream.on('progress', flushOnFinish(transformStream, progressEventDecorator(responseLength, progressEventReducer(asyncDecorator(onDownloadProgress), true, 3)))); + onDownloadProgress && transformStream.on('progress', flushOnFinish(transformStream, progressEventDecorator(responseLength, progressEventReducer(asyncDecorator(onDownloadProgress, scheduleProgress), true, 3)))); streams.push(transformStream); } @@ -20146,6 +20491,12 @@ function requireAxios () { const headersToObject = thing => thing instanceof AxiosHeaders ? { ...thing } : thing; + const ownEnumerableKeys = thing => { + if (Object.getOwnPropertySymbols && Object.getOwnPropertyDescriptor) { + return Object.keys(thing).concat(Object.getOwnPropertySymbols(thing).filter(symbol => Object.getOwnPropertyDescriptor(thing, symbol).enumerable)); + } + return Object.keys(thing); + }; /** * Config-specific merge-function which creates a new config-object @@ -20268,7 +20619,7 @@ function requireAxios () { validateStatus: mergeDirectKeys, headers: (a, b, prop) => mergeDeepProperties(headersToObject(a), headersToObject(b), prop, true) }; - utils$1.forEach(Object.keys({ + utils$1.forEach(ownEnumerableKeys({ ...config1, ...config2 }), function computeConfigValue(prop) { @@ -20289,19 +20640,6 @@ function requireAxios () { return config; } - const FORM_DATA_CONTENT_HEADERS = ['content-type', 'content-length']; - function setFormDataHeaders(headers, formHeaders, policy) { - if (policy !== 'content-only') { - headers.set(formHeaders); - return; - } - Object.entries(formHeaders || {}).forEach(([key, val]) => { - if (FORM_DATA_CONTENT_HEADERS.includes(key.toLowerCase())) { - headers.set(key, val); - } - }); - } - /** * Encode a UTF-8 string to a Latin-1 byte string for use with btoa(). * This is a modern replacement for the deprecated unescape(encodeURIComponent(str)) pattern. @@ -20577,9 +20915,18 @@ function requireAxios () { }); signals = null; }; - signals.forEach(signal => signal.addEventListener('abort', onabort, { - once: true - })); + signals.forEach(signal => { + if (aborted) { + return; + } + if (signal.aborted) { + onabort.call(signal); + return; + } + signal.addEventListener('abort', onabort, { + once: true + }); + }); const { signal } = controller; @@ -21520,16 +21867,29 @@ function requireAxios () { const onFulfilled = requestInterceptorChain[i++]; const onRejected = requestInterceptorChain[i++]; try { - newConfig = onFulfilled(newConfig); + newConfig = onFulfilled ? onFulfilled(newConfig) : newConfig; } catch (error) { - onRejected.call(this, error); + if (!onRejected) { + promise = Promise.reject(error); + break; + } + try { + const rejectedResult = onRejected.call(this, error); + if (utils$1.isThenable(rejectedResult)) { + promise = Promise.resolve(rejectedResult).then(() => dispatchRequest.call(this, newConfig)); + } + } catch (rejectedError) { + promise = Promise.reject(rejectedError); + } break; } } - try { - promise = dispatchRequest.call(this, newConfig); - } catch (error) { - return Promise.reject(error); + if (!promise) { + try { + promise = dispatchRequest.call(this, newConfig); + } catch (error) { + promise = Promise.reject(error); + } } i = 0; len = responseInterceptorChain.length; @@ -21795,6 +22155,7 @@ function requireAxios () { LoopDetected: 508, NotExtended: 510, NetworkAuthenticationRequired: 511, + WebServerReturnsAnUnknownError: 520, WebServerIsDown: 521, ConnectionTimedOut: 522, OriginIsUnreachable: 523, @@ -21871,7 +22232,6 @@ function requireAxios () { axios.default = axios; axios_1 = axios; - return axios_1; } diff --git a/package-lock.json b/package-lock.json index b6643c7..a07fb4e 100644 --- a/package-lock.json +++ b/package-lock.json @@ -11,7 +11,7 @@ "dependencies": { "@actions/core": "^3.0.1", "@actions/github": "^9.1.1", - "axios": "^1.18.1" + "axios": "^1.19.0" }, "devDependencies": { "@babel/core": "^7.29.6", @@ -4437,13 +4437,13 @@ "license": "MIT" }, "node_modules/axios": { - "version": "1.18.1", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.1.tgz", - "integrity": "sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==", + "version": "1.19.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.19.0.tgz", + "integrity": "sha512-ht/iuYZXEjFxLH/Hkezgd7m6JKlHHXEUSneaDz8uZe1Gj5QZtCnpyDsckvAiEnT89OEbCLmnte4R4sn7P0EKFw==", "license": "MIT", "dependencies": { "follow-redirects": "^1.16.0", - "form-data": "^4.0.5", + "form-data": "^4.0.6", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } diff --git a/package.json b/package.json index 8f844aa..6d0c3bf 100644 --- a/package.json +++ b/package.json @@ -26,7 +26,7 @@ "dependencies": { "@actions/core": "^3.0.1", "@actions/github": "^9.1.1", - "axios": "^1.18.1" + "axios": "^1.19.0" }, "devDependencies": { "@babel/core": "^7.29.6",