From c9b04018b4bcf7872587d2169ce7037f5bdf22b2 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 14:26:11 +0000 Subject: [PATCH 1/4] fix: apply audit fixes --- dist/save-cache/index.cjs | 1497 ++++++++----------------------------- 1 file changed, 332 insertions(+), 1165 deletions(-) diff --git a/dist/save-cache/index.cjs b/dist/save-cache/index.cjs index 21dd34b..f1b1e57 100644 --- a/dist/save-cache/index.cjs +++ b/dist/save-cache/index.cjs @@ -1929,7 +1929,11 @@ var require_request = __commonJS({ } else if (typeof val[i] === "object") { throw new InvalidArgumentError(`invalid ${key} header`); } else { - arr.push(`${val[i]}`); + const str = `${val[i]}`; + if (!isValidHeaderValue(str)) { + throw new InvalidArgumentError(`invalid ${key} header`); + } + arr.push(str); } } val = arr; @@ -1941,6 +1945,9 @@ var require_request = __commonJS({ val = ""; } else { val = `${val}`; + if (!isValidHeaderValue(val)) { + throw new InvalidArgumentError(`invalid ${key} header`); + } } if (headerName === "host") { if (request.host !== null) { @@ -5671,6 +5678,7 @@ var require_client_h1 = __commonJS({ RequestContentLengthMismatchError, ResponseContentLengthMismatchError, RequestAbortedError, + InvalidArgumentError, HeadersTimeoutError, HeadersOverflowError, SocketError, @@ -6397,8 +6405,16 @@ var require_client_h1 = __commonJS({ } body2 = bodyStream.stream; contentLength2 = bodyStream.length; - } else if (util7.isBlobLike(body2) && request.contentType == null && body2.type) { - headers.push("content-type", body2.type); + } else if (util7.isBlobLike(body2) && request.contentType == null) { + const contentType2 = body2.type; + if (contentType2) { + const contentTypeValue = `${contentType2}`; + if (!util7.isValidHeaderValue(contentTypeValue)) { + util7.errorRequest(client, request, new InvalidArgumentError("invalid content-type header")); + return false; + } + headers.push("content-type", contentTypeValue); + } } if (body2 && typeof body2.read === "function") { body2.read(0); @@ -8950,6 +8966,24 @@ var require_retry_handler = __commonJS({ const current = Date.now(); return new Date(retryAfter).getTime() - current; } + function validatePartialResponseContentLength(headers, range3, statusCode, retryCount) { + const contentLength2 = headers["content-length"]; + if (contentLength2 == null) { + return null; + } + if (!Number.isFinite(range3.start) || !Number.isFinite(range3.end)) { + return null; + } + const length = Number(contentLength2); + const expectedLength = range3.end - range3.start + 1; + if (!Number.isFinite(length) || length !== expectedLength) { + return new RequestRetryError("Content-Length mismatch", statusCode, { + headers, + data: { count: retryCount } + }); + } + return null; + } var RetryHandler = class _RetryHandler { constructor(opts, handlers) { const { retryOptions, ...dispatchOpts } = opts; @@ -9122,6 +9156,11 @@ var require_retry_handler = __commonJS({ ); return false; } + const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount); + if (contentLengthError != null) { + this.abort(contentLengthError); + return false; + } const { start, size, end = size - 1 } = contentRange; assert4(this.start === start, "content-range mismatch"); assert4(this.end == null || this.end === end, "content-range mismatch"); @@ -9139,6 +9178,11 @@ var require_retry_handler = __commonJS({ statusMessage ); } + const contentLengthError = validatePartialResponseContentLength(headers, range3, statusCode, this.retryCount); + if (contentLengthError != null) { + this.abort(contentLengthError); + return false; + } const { start, size, end = size - 1 } = range3; assert4( start != null && Number.isFinite(start), @@ -15984,14 +16028,48 @@ var require_util6 = __commonJS({ for (let i = 0; i < path13.length; ++i) { const code = path13.charCodeAt(i); if (code < 32 || // exclude CTLs (0-31) - code === 127 || // DEL + code > 126 || // exclude DEL and non-ascii code === 59) { throw new Error("Invalid cookie path"); } } } + function isLetterOrDigit(code) { + return code >= 48 && code <= 57 || // 0-9 + code >= 65 && code <= 90 || // A-Z + code >= 97 && code <= 122; + } function validateCookieDomain(domain) { - if (domain.startsWith("-") || domain.endsWith(".") || domain.endsWith("-")) { + if (domain === " ") { + return; + } + if (domain.length > 255) { + throw new Error("Invalid cookie domain"); + } + let labelLength = 0; + for (let i = 0; i < domain.length; ++i) { + const code = domain.charCodeAt(i); + if (code === 46) { + if (labelLength === 0) { + throw new Error("Invalid cookie domain"); + } + if (domain.charCodeAt(i - 1) === 45) { + throw new Error("Invalid cookie domain"); + } + labelLength = 0; + continue; + } + if (labelLength === 0 && !isLetterOrDigit(code)) { + throw new Error("Invalid cookie domain"); + } + if (!isLetterOrDigit(code) && code !== 45) { + throw new Error("Invalid cookie domain"); + } + if (++labelLength > 63) { + throw new Error("Invalid cookie domain"); + } + } + if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 45) { throw new Error("Invalid cookie domain"); } } @@ -16074,7 +16152,11 @@ var require_util6 = __commonJS({ throw new Error("Invalid unparsed"); } const [key, ...value] = part.split("="); - out.push(`${key.trim()}=${value.join("=")}`); + const trimmedKey = key.trim(); + const joinedValue = value.join("="); + validateCookieName(trimmedKey); + validateCookieValue(joinedValue); + out.push(`${trimmedKey}=${joinedValue}`); } return out.join("; "); } @@ -18834,6 +18916,8 @@ var require_brace_expansion = __commonJS({ var escClose2 = "\0CLOSE" + Math.random() + "\0"; var escComma2 = "\0COMMA" + Math.random() + "\0"; var escPeriod2 = "\0PERIOD" + Math.random() + "\0"; + var EXPANSION_MAX2 = 1e5; + var EXPANSION_MAX_LENGTH2 = 4e6; function numeric2(str) { return parseInt(str, 10) == str ? parseInt(str, 10) : str.charCodeAt(0); } @@ -18867,11 +18951,12 @@ var require_brace_expansion = __commonJS({ if (!str) return []; options = options || {}; - var max = options.max == null ? Infinity : options.max; + var max = options.max == null ? EXPANSION_MAX2 : options.max; + var maxLength = options.maxLength == null ? EXPANSION_MAX_LENGTH2 : options.maxLength; if (str.substr(0, 2) === "{}") { str = "\\{\\}" + str.substr(2); } - return expand2(escapeBraces2(str), max, true).map(unescapeBraces2); + return expand2(escapeBraces2(str), max, maxLength, true).map(unescapeBraces2); } function embrace2(str) { return "{" + str + "}"; @@ -18885,11 +18970,82 @@ var require_brace_expansion = __commonJS({ function gte2(i, y) { return i >= y; } - function expand2(str, max, isTop) { - var expansions = []; + function combine2(acc, base, pre, values, max, maxLength, dropEmpties, outBase) { + var out = []; + var length = 0; + for (var a = 0; a < acc.length; a++) { + for (var v = 0; v < values.length; v++) { + if (out.length >= max) return out; + var expansion = acc[a] + pre + values[v]; + if (dropEmpties && expansion.length === base[a]) continue; + if (length + expansion.length > maxLength) return out; + out.push(expansion); + outBase.push(base[a]); + length += expansion.length; + } + } + return out; + } + function expandSequence2(body2, isAlphaSequence, max, maxLength) { + var n = body2.split(/\.\./); + var N = []; + if (n[0] === void 0 || n[1] === void 0) { + return N; + } + var x = numeric2(n[0]); + var y = numeric2(n[1]); + var width = Math.max(n[0].length, n[1].length); + var incr = n.length === 3 && n[2] !== void 0 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; + var test2 = lte2; + var reverse = y < x; + if (reverse) { + incr *= -1; + test2 = gte2; + } + var pad = n.some(isPadded2); + var length = 0; + for (var i = x; test2(i, y) && N.length < max; i += incr) { + var c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === "\\") { + c = ""; + } + } else { + c = String(i); + if (pad) { + var need = width - c.length; + if (need > 0) { + var z = new Array(need + 1).join("0"); + if (i < 0) { + c = "-" + z + c.slice(1); + } else { + c = z + c; + } + } + } + } + if (length + c.length > maxLength) break; + N.push(c); + length += c.length; + } + return N; + } + function expand2(str, max, maxLength, isTop) { + var acc = [""]; + var accBase = [0]; + var dropEmpties = false; + var firstGroup = true; + var nextBase; for (; ; ) { var m = balanced2("{", "}", str); - if (!m || /\$$/.test(m.pre)) return [str]; + if (!m) { + return combine2(acc, accBase, str, [""], max, maxLength, dropEmpties, []); + } + var pre = m.pre; + if (/\$$/.test(pre)) { + return combine2(acc, accBase, str, [""], max, maxLength, dropEmpties, []); + } var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); var isSequence = isNumericSequence || isAlphaSequence; @@ -18898,76 +19054,91 @@ var require_brace_expansion = __commonJS({ if (m.post.match(/,(?!,).*\}/)) { str = m.pre + "{" + m.body + escClose2 + m.post; isTop = true; + firstGroup = true; + dropEmpties = false; + accBase = []; + for (var b = 0; b < acc.length; b++) { + accBase.push(acc[b].length); + } continue; } - return [str]; + return combine2( + acc, + accBase, + pre + "{" + m.body + "}" + m.post, + [""], + max, + maxLength, + dropEmpties, + [] + ); + } + if (firstGroup) { + dropEmpties = isTop && !isSequence; + firstGroup = false; } - var n; + var values; if (isSequence) { - n = m.body.split(/\.\./); + values = expandSequence2(m.body, isAlphaSequence, max, maxLength); } else { - n = parseCommaParts2(m.body); - if (n.length === 1) { - n = expand2(n[0], max, false).map(embrace2); + var n = parseCommaParts2(m.body); + if (n.length === 1 && n[0] !== void 0) { + n = expand2(n[0], max, maxLength, false).map(embrace2); if (n.length === 1) { - var post = m.post.length ? expand2(m.post, max, false) : [""]; - return post.map(function(p) { - return m.pre + n[0] + p; - }); + nextBase = []; + acc = combine2( + acc, + accBase, + pre + n[0], + [""], + max, + maxLength, + dropEmpties && !m.post.length, + nextBase + ); + accBase = nextBase; + if (!m.post.length) break; + str = m.post; + continue; } } - } - var pre = m.pre; - var post = m.post.length ? expand2(m.post, max, false) : [""]; - var N; - if (isSequence) { - var x = numeric2(n[0]); - var y = numeric2(n[1]); - var width = Math.max(n[0].length, n[1].length); - var incr = n.length == 3 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; - var test2 = lte2; - var reverse = y < x; - if (reverse) { - incr *= -1; - test2 = gte2; - } - var pad = n.some(isPadded2); - N = []; - for (var i = x; test2(i, y) && N.length < max; i += incr) { - var c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === "\\") - c = ""; - } else { - c = String(i); - if (pad) { - var need = width - c.length; - if (need > 0) { - var z = new Array(need + 1).join("0"); - if (i < 0) - c = "-" + z + c.slice(1); - else - c = z + c; - } - } + var dropsEmpties = dropEmpties && !m.post.length && !pre; + for (var d = 0; dropsEmpties && d < acc.length; d++) { + if (acc[d].length !== accBase[d]) { + dropsEmpties = false; } - N.push(c); } - } else { - N = concatMap(n, function(el) { - return expand2(el, max, false); - }); - } - for (var j = 0; j < N.length; j++) { - for (var k = 0; k < post.length && expansions.length < max; k++) { - var expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) - expansions.push(expansion); + values = []; + var valuesLength = 0; + outer: for (var j = 0; j < n.length; j++) { + var expanded = expand2(n[j], max, maxLength, false); + for (var k = 0; k < expanded.length; k++) { + var v = expanded[k]; + if (dropsEmpties && !v) continue; + if (values.length >= max || valuesLength + v.length > maxLength) { + break outer; + } + values.push(v); + valuesLength += v.length; + } } } - return expansions; + nextBase = []; + acc = combine2( + acc, + accBase, + pre, + values, + max, + maxLength, + dropEmpties && !m.post.length, + nextBase + ); + accBase = nextBase; + if (!m.post.length) break; + str = m.post; } + return acc; } } }); @@ -46481,940 +46652,6 @@ function getPositionFromMatch(match4) { } // node_modules/@nodable/entities/src/entities.js -var BASIC_LATIN = { - amp: "&", - AMP: "&", - lt: "<", - LT: "<", - gt: ">", - GT: ">", - quot: '"', - QUOT: '"', - apos: "'", - lsquo: "\u2018", - rsquo: "\u2019", - ldquo: "\u201C", - rdquo: "\u201D", - lsquor: "\u201A", - rsquor: "\u2019", - ldquor: "\u201E", - bdquo: "\u201E", - comma: ",", - period: ".", - colon: ":", - semi: ";", - excl: "!", - quest: "?", - num: "#", - dollar: "$", - percent: "%", - ast: "*", - commat: "@", - lowbar: "_", - verbar: "|", - vert: "|", - sol: "/", - bsol: "\\", - lbrace: "{", - rbrace: "}", - lbrack: "[", - rbrack: "]", - lpar: "(", - rpar: ")", - nbsp: "\xA0", - iexcl: "\xA1", - cent: "\xA2", - pound: "\xA3", - curren: "\xA4", - yen: "\xA5", - brvbar: "\xA6", - sect: "\xA7", - uml: "\xA8", - copy: "\xA9", - COPY: "\xA9", - ordf: "\xAA", - laquo: "\xAB", - not: "\xAC", - shy: "\xAD", - reg: "\xAE", - REG: "\xAE", - macr: "\xAF", - deg: "\xB0", - plusmn: "\xB1", - sup2: "\xB2", - sup3: "\xB3", - acute: "\xB4", - micro: "\xB5", - para: "\xB6", - middot: "\xB7", - cedil: "\xB8", - sup1: "\xB9", - ordm: "\xBA", - raquo: "\xBB", - frac14: "\xBC", - frac12: "\xBD", - half: "\xBD", - frac34: "\xBE", - iquest: "\xBF", - times: "\xD7", - div: "\xF7", - divide: "\xF7" -}; -var LATIN_ACCENTS = { - Agrave: "\xC0", - agrave: "\xE0", - Aacute: "\xC1", - aacute: "\xE1", - Acirc: "\xC2", - acirc: "\xE2", - Atilde: "\xC3", - atilde: "\xE3", - Auml: "\xC4", - auml: "\xE4", - Aring: "\xC5", - aring: "\xE5", - AElig: "\xC6", - aelig: "\xE6", - Ccedil: "\xC7", - ccedil: "\xE7", - Egrave: "\xC8", - egrave: "\xE8", - Eacute: "\xC9", - eacute: "\xE9", - Ecirc: "\xCA", - ecirc: "\xEA", - Euml: "\xCB", - euml: "\xEB", - Igrave: "\xCC", - igrave: "\xEC", - Iacute: "\xCD", - iacute: "\xED", - Icirc: "\xCE", - icirc: "\xEE", - Iuml: "\xCF", - iuml: "\xEF", - ETH: "\xD0", - eth: "\xF0", - Ntilde: "\xD1", - ntilde: "\xF1", - Ograve: "\xD2", - ograve: "\xF2", - Oacute: "\xD3", - oacute: "\xF3", - Ocirc: "\xD4", - ocirc: "\xF4", - Otilde: "\xD5", - otilde: "\xF5", - Ouml: "\xD6", - ouml: "\xF6", - Oslash: "\xD8", - oslash: "\xF8", - Ugrave: "\xD9", - ugrave: "\xF9", - Uacute: "\xDA", - uacute: "\xFA", - Ucirc: "\xDB", - ucirc: "\xFB", - Uuml: "\xDC", - uuml: "\xFC", - Yacute: "\xDD", - yacute: "\xFD", - THORN: "\xDE", - thorn: "\xFE", - szlig: "\xDF", - yuml: "\xFF", - Yuml: "\u0178" -}; -var LATIN_EXTENDED = { - Amacr: "\u0100", - amacr: "\u0101", - Abreve: "\u0102", - abreve: "\u0103", - Aogon: "\u0104", - aogon: "\u0105", - Cacute: "\u0106", - cacute: "\u0107", - Ccirc: "\u0108", - ccirc: "\u0109", - Cdot: "\u010A", - cdot: "\u010B", - Ccaron: "\u010C", - ccaron: "\u010D", - Dcaron: "\u010E", - dcaron: "\u010F", - Dstrok: "\u0110", - dstrok: "\u0111", - Emacr: "\u0112", - emacr: "\u0113", - Ecaron: "\u011A", - ecaron: "\u011B", - Edot: "\u0116", - edot: "\u0117", - Eogon: "\u0118", - eogon: "\u0119", - Gcirc: "\u011C", - gcirc: "\u011D", - Gbreve: "\u011E", - gbreve: "\u011F", - Gdot: "\u0120", - gdot: "\u0121", - Gcedil: "\u0122", - Hcirc: "\u0124", - hcirc: "\u0125", - Hstrok: "\u0126", - hstrok: "\u0127", - Itilde: "\u0128", - itilde: "\u0129", - Imacr: "\u012A", - imacr: "\u012B", - Iogon: "\u012E", - iogon: "\u012F", - Idot: "\u0130", - IJlig: "\u0132", - ijlig: "\u0133", - Jcirc: "\u0134", - jcirc: "\u0135", - Kcedil: "\u0136", - kcedil: "\u0137", - kgreen: "\u0138", - Lacute: "\u0139", - lacute: "\u013A", - Lcedil: "\u013B", - lcedil: "\u013C", - Lcaron: "\u013D", - lcaron: "\u013E", - Lmidot: "\u013F", - lmidot: "\u0140", - Lstrok: "\u0141", - lstrok: "\u0142", - Nacute: "\u0143", - nacute: "\u0144", - Ncaron: "\u0147", - ncaron: "\u0148", - Ncedil: "\u0145", - ncedil: "\u0146", - ENG: "\u014A", - eng: "\u014B", - Omacr: "\u014C", - omacr: "\u014D", - Odblac: "\u0150", - odblac: "\u0151", - OElig: "\u0152", - oelig: "\u0153", - Racute: "\u0154", - racute: "\u0155", - Rcaron: "\u0158", - rcaron: "\u0159", - Rcedil: "\u0156", - rcedil: "\u0157", - Sacute: "\u015A", - sacute: "\u015B", - Scirc: "\u015C", - scirc: "\u015D", - Scedil: "\u015E", - scedil: "\u015F", - Scaron: "\u0160", - scaron: "\u0161", - Tcedil: "\u0162", - tcedil: "\u0163", - Tcaron: "\u0164", - tcaron: "\u0165", - Tstrok: "\u0166", - tstrok: "\u0167", - Utilde: "\u0168", - utilde: "\u0169", - Umacr: "\u016A", - umacr: "\u016B", - Ubreve: "\u016C", - ubreve: "\u016D", - Uring: "\u016E", - uring: "\u016F", - Udblac: "\u0170", - udblac: "\u0171", - Uogon: "\u0172", - uogon: "\u0173", - Wcirc: "\u0174", - wcirc: "\u0175", - Ycirc: "\u0176", - ycirc: "\u0177", - Zacute: "\u0179", - zacute: "\u017A", - Zdot: "\u017B", - zdot: "\u017C", - Zcaron: "\u017D", - zcaron: "\u017E" -}; -var GREEK = { - Alpha: "\u0391", - alpha: "\u03B1", - Beta: "\u0392", - beta: "\u03B2", - Gamma: "\u0393", - gamma: "\u03B3", - Delta: "\u0394", - delta: "\u03B4", - Epsilon: "\u0395", - epsilon: "\u03B5", - epsiv: "\u03F5", - varepsilon: "\u03F5", - Zeta: "\u0396", - zeta: "\u03B6", - Eta: "\u0397", - eta: "\u03B7", - Theta: "\u0398", - theta: "\u03B8", - thetasym: "\u03D1", - vartheta: "\u03D1", - Iota: "\u0399", - iota: "\u03B9", - Kappa: "\u039A", - kappa: "\u03BA", - kappav: "\u03F0", - varkappa: "\u03F0", - Lambda: "\u039B", - lambda: "\u03BB", - Mu: "\u039C", - mu: "\u03BC", - Nu: "\u039D", - nu: "\u03BD", - Xi: "\u039E", - xi: "\u03BE", - Omicron: "\u039F", - omicron: "\u03BF", - Pi: "\u03A0", - pi: "\u03C0", - piv: "\u03D6", - varpi: "\u03D6", - Rho: "\u03A1", - rho: "\u03C1", - rhov: "\u03F1", - varrho: "\u03F1", - Sigma: "\u03A3", - sigma: "\u03C3", - sigmaf: "\u03C2", - sigmav: "\u03C2", - varsigma: "\u03C2", - Tau: "\u03A4", - tau: "\u03C4", - Upsilon: "\u03A5", - upsilon: "\u03C5", - upsi: "\u03C5", - Upsi: "\u03D2", - upsih: "\u03D2", - Phi: "\u03A6", - phi: "\u03C6", - phiv: "\u03D5", - varphi: "\u03D5", - Chi: "\u03A7", - chi: "\u03C7", - Psi: "\u03A8", - psi: "\u03C8", - Omega: "\u03A9", - omega: "\u03C9", - ohm: "\u03A9", - Gammad: "\u03DC", - gammad: "\u03DD", - digamma: "\u03DD" -}; -var CYRILLIC = { - Afr: "\u{1D504}", - afr: "\u{1D51E}", - Acy: "\u0410", - acy: "\u0430", - Bcy: "\u0411", - bcy: "\u0431", - Vcy: "\u0412", - vcy: "\u0432", - Gcy: "\u0413", - gcy: "\u0433", - Dcy: "\u0414", - dcy: "\u0434", - IEcy: "\u0415", - iecy: "\u0435", - IOcy: "\u0401", - iocy: "\u0451", - ZHcy: "\u0416", - zhcy: "\u0436", - Zcy: "\u0417", - zcy: "\u0437", - Icy: "\u0418", - icy: "\u0438", - Jcy: "\u0419", - jcy: "\u0439", - Kcy: "\u041A", - kcy: "\u043A", - Lcy: "\u041B", - lcy: "\u043B", - Mcy: "\u041C", - mcy: "\u043C", - Ncy: "\u041D", - ncy: "\u043D", - Ocy: "\u041E", - ocy: "\u043E", - Pcy: "\u041F", - pcy: "\u043F", - Rcy: "\u0420", - rcy: "\u0440", - Scy: "\u0421", - scy: "\u0441", - Tcy: "\u0422", - tcy: "\u0442", - Ucy: "\u0423", - ucy: "\u0443", - Fcy: "\u0424", - fcy: "\u0444", - KHcy: "\u0425", - khcy: "\u0445", - TScy: "\u0426", - tscy: "\u0446", - CHcy: "\u0427", - chcy: "\u0447", - SHcy: "\u0428", - shcy: "\u0448", - SHCHcy: "\u0429", - shchcy: "\u0449", - HARDcy: "\u042A", - hardcy: "\u044A", - Ycy: "\u042B", - ycy: "\u044B", - SOFTcy: "\u042C", - softcy: "\u044C", - Ecy: "\u042D", - ecy: "\u044D", - YUcy: "\u042E", - yucy: "\u044E", - YAcy: "\u042F", - yacy: "\u044F", - DJcy: "\u0402", - djcy: "\u0452", - GJcy: "\u0403", - gjcy: "\u0453", - Jukcy: "\u0404", - jukcy: "\u0454", - DScy: "\u0405", - dscy: "\u0455", - Iukcy: "\u0406", - iukcy: "\u0456", - YIcy: "\u0407", - yicy: "\u0457", - Jsercy: "\u0408", - jsercy: "\u0458", - LJcy: "\u0409", - ljcy: "\u0459", - NJcy: "\u040A", - njcy: "\u045A", - TSHcy: "\u040B", - tshcy: "\u045B", - KJcy: "\u040C", - kjcy: "\u045C", - Ubrcy: "\u040E", - ubrcy: "\u045E", - DZcy: "\u040F", - dzcy: "\u045F" -}; -var MATH = { - plus: "+", - pm: "\xB1", - times: "\xD7", - div: "\xF7", - divide: "\xF7", - sdot: "\u22C5", - star: "\u2606", - starf: "\u2605", - bigstar: "\u2605", - lowast: "\u2217", - ast: "*", - midast: "*", - compfn: "\u2218", - smallcircle: "\u2218", - bullet: "\u2022", - bull: "\u2022", - nbsp: "\xA0", - hellip: "\u2026", - mldr: "\u2026", - prime: "\u2032", - Prime: "\u2033", - tprime: "\u2034", - bprime: "\u2035", - backprime: "\u2035", - minus: "\u2212", - minusd: "\u2238", - dotminus: "\u2238", - plusdo: "\u2214", - dotplus: "\u2214", - plusmn: "\xB1", - minusplus: "\u2213", - mnplus: "\u2213", - mp: "\u2213", - setminus: "\u2216", - smallsetminus: "\u2216", - Backslash: "\u2216", - setmn: "\u2216", - ssetmn: "\u2216", - lowbar: "_", - verbar: "|", - vert: "|", - VerticalLine: "|", - colon: ":", - Colon: "\u2237", - Proportion: "\u2237", - ratio: "\u2236", - equals: "=", - ne: "\u2260", - nequiv: "\u2262", - equiv: "\u2261", - Congruent: "\u2261", - sim: "\u223C", - thicksim: "\u223C", - thksim: "\u223C", - sime: "\u2243", - simeq: "\u2243", - TildeEqual: "\u2243", - asymp: "\u2248", - approx: "\u2248", - thickapprox: "\u2248", - thkap: "\u2248", - TildeTilde: "\u2248", - ncong: "\u2247", - cong: "\u2245", - TildeFullEqual: "\u2245", - asympeq: "\u224D", - CupCap: "\u224D", - bump: "\u224E", - Bumpeq: "\u224E", - HumpDownHump: "\u224E", - bumpe: "\u224F", - bumpeq: "\u224F", - HumpEqual: "\u224F", - le: "\u2264", - LessEqual: "\u2264", - ge: "\u2265", - GreaterEqual: "\u2265", - lesseqgtr: "\u22DA", - lesseqqgtr: "\u2A8B", - greater: ">", - less: "<" -}; -var MATH_ADVANCED = { - alefsym: "\u2135", - aleph: "\u2135", - beth: "\u2136", - gimel: "\u2137", - daleth: "\u2138", - forall: "\u2200", - ForAll: "\u2200", - part: "\u2202", - PartialD: "\u2202", - exist: "\u2203", - Exists: "\u2203", - nexist: "\u2204", - nexists: "\u2204", - empty: "\u2205", - emptyset: "\u2205", - emptyv: "\u2205", - varnothing: "\u2205", - nabla: "\u2207", - Del: "\u2207", - isin: "\u2208", - isinv: "\u2208", - in: "\u2208", - Element: "\u2208", - notin: "\u2209", - notinva: "\u2209", - ni: "\u220B", - niv: "\u220B", - SuchThat: "\u220B", - ReverseElement: "\u220B", - notni: "\u220C", - notniva: "\u220C", - prod: "\u220F", - Product: "\u220F", - coprod: "\u2210", - Coproduct: "\u2210", - sum: "\u2211", - Sum: "\u2211", - minus: "\u2212", - mp: "\u2213", - plusdo: "\u2214", - dotplus: "\u2214", - setminus: "\u2216", - lowast: "\u2217", - radic: "\u221A", - Sqrt: "\u221A", - prop: "\u221D", - propto: "\u221D", - Proportional: "\u221D", - varpropto: "\u221D", - infin: "\u221E", - infintie: "\u29DD", - ang: "\u2220", - angle: "\u2220", - angmsd: "\u2221", - measuredangle: "\u2221", - angsph: "\u2222", - mid: "\u2223", - VerticalBar: "\u2223", - nmid: "\u2224", - nsmid: "\u2224", - npar: "\u2226", - parallel: "\u2225", - spar: "\u2225", - nparallel: "\u2226", - nspar: "\u2226", - and: "\u2227", - wedge: "\u2227", - or: "\u2228", - vee: "\u2228", - cap: "\u2229", - cup: "\u222A", - int: "\u222B", - Integral: "\u222B", - conint: "\u222E", - ContourIntegral: "\u222E", - Conint: "\u222F", - DoubleContourIntegral: "\u222F", - Cconint: "\u2230", - there4: "\u2234", - therefore: "\u2234", - Therefore: "\u2234", - becaus: "\u2235", - because: "\u2235", - Because: "\u2235", - ratio: "\u2236", - Proportion: "\u2237", - minusd: "\u2238", - dotminus: "\u2238", - mDDot: "\u223A", - homtht: "\u223B", - sim: "\u223C", - bsimg: "\u223D", - backsim: "\u223D", - ac: "\u223E", - mstpos: "\u223E", - acd: "\u223F", - VerticalTilde: "\u2240", - wr: "\u2240", - wreath: "\u2240", - nsime: "\u2244", - nsimeq: "\u2244", - ncong: "\u2247", - simne: "\u2246", - ncongdot: "\u2A6D\u0338", - ngsim: "\u2275", - nsim: "\u2241", - napprox: "\u2249", - nap: "\u2249", - ngeq: "\u2271", - nge: "\u2271", - nleq: "\u2270", - nle: "\u2270", - ngtr: "\u226F", - ngt: "\u226F", - nless: "\u226E", - nlt: "\u226E", - nprec: "\u2280", - npr: "\u2280", - nsucc: "\u2281", - nsc: "\u2281" -}; -var ARROWS = { - larr: "\u2190", - leftarrow: "\u2190", - LeftArrow: "\u2190", - uarr: "\u2191", - uparrow: "\u2191", - UpArrow: "\u2191", - rarr: "\u2192", - rightarrow: "\u2192", - RightArrow: "\u2192", - darr: "\u2193", - downarrow: "\u2193", - DownArrow: "\u2193", - harr: "\u2194", - leftrightarrow: "\u2194", - LeftRightArrow: "\u2194", - varr: "\u2195", - updownarrow: "\u2195", - UpDownArrow: "\u2195", - nwarr: "\u2196", - nwarrow: "\u2196", - UpperLeftArrow: "\u2196", - nearr: "\u2197", - nearrow: "\u2197", - UpperRightArrow: "\u2197", - searr: "\u2198", - searrow: "\u2198", - LowerRightArrow: "\u2198", - swarr: "\u2199", - swarrow: "\u2199", - LowerLeftArrow: "\u2199", - lArr: "\u21D0", - Leftarrow: "\u21D0", - uArr: "\u21D1", - Uparrow: "\u21D1", - rArr: "\u21D2", - Rightarrow: "\u21D2", - dArr: "\u21D3", - Downarrow: "\u21D3", - hArr: "\u21D4", - Leftrightarrow: "\u21D4", - iff: "\u21D4", - vArr: "\u21D5", - Updownarrow: "\u21D5", - lAarr: "\u21DA", - Lleftarrow: "\u21DA", - rAarr: "\u21DB", - Rrightarrow: "\u21DB", - lrarr: "\u21C6", - leftrightarrows: "\u21C6", - rlarr: "\u21C4", - rightleftarrows: "\u21C4", - lrhar: "\u21CB", - leftrightharpoons: "\u21CB", - ReverseEquilibrium: "\u21CB", - rlhar: "\u21CC", - rightleftharpoons: "\u21CC", - Equilibrium: "\u21CC", - udarr: "\u21C5", - UpArrowDownArrow: "\u21C5", - duarr: "\u21F5", - DownArrowUpArrow: "\u21F5", - llarr: "\u21C7", - leftleftarrows: "\u21C7", - rrarr: "\u21C9", - rightrightarrows: "\u21C9", - ddarr: "\u21CA", - downdownarrows: "\u21CA", - har: "\u21BD", - lhard: "\u21BD", - leftharpoondown: "\u21BD", - lharu: "\u21BC", - leftharpoonup: "\u21BC", - rhard: "\u21C1", - rightharpoondown: "\u21C1", - rharu: "\u21C0", - rightharpoonup: "\u21C0", - lsh: "\u21B0", - Lsh: "\u21B0", - rsh: "\u21B1", - Rsh: "\u21B1", - ldsh: "\u21B2", - rdsh: "\u21B3", - hookleftarrow: "\u21A9", - hookrightarrow: "\u21AA", - mapstoleft: "\u21A4", - mapstoup: "\u21A5", - map: "\u21A6", - mapsto: "\u21A6", - mapstodown: "\u21A7", - crarr: "\u21B5", - nleftarrow: "\u219A", - nleftrightarrow: "\u21AE", - nrightarrow: "\u219B", - nrarr: "\u219B", - larrtl: "\u21A2", - rarrtl: "\u21A3", - leftarrowtail: "\u21A2", - rightarrowtail: "\u21A3", - twoheadleftarrow: "\u219E", - twoheadrightarrow: "\u21A0", - Larr: "\u219E", - Rarr: "\u21A0", - larrhk: "\u21A9", - rarrhk: "\u21AA", - larrlp: "\u21AB", - looparrowleft: "\u21AB", - rarrlp: "\u21AC", - looparrowright: "\u21AC", - harrw: "\u21AD", - leftrightsquigarrow: "\u21AD", - nrarrw: "\u219D\u0338", - rarrw: "\u219D", - rightsquigarrow: "\u219D", - larrbfs: "\u291F", - rarrbfs: "\u2920", - nvHarr: "\u2904", - nvlArr: "\u2902", - nvrArr: "\u2903", - larrfs: "\u291D", - rarrfs: "\u291E", - Map: "\u2905", - larrsim: "\u2973", - rarrsim: "\u2974", - harrcir: "\u2948", - Uarrocir: "\u2949", - lurdshar: "\u294A", - ldrdhar: "\u2967", - ldrushar: "\u294B", - rdldhar: "\u2969", - lrhard: "\u296D", - uharr: "\u21BE", - uharl: "\u21BF", - dharr: "\u21C2", - dharl: "\u21C3", - Uarr: "\u219F", - Darr: "\u21A1", - zigrarr: "\u21DD", - nwArr: "\u21D6", - neArr: "\u21D7", - seArr: "\u21D8", - swArr: "\u21D9", - nharr: "\u21AE", - nhArr: "\u21CE", - nlarr: "\u219A", - nlArr: "\u21CD", - nrArr: "\u21CF", - larrb: "\u21E4", - LeftArrowBar: "\u21E4", - rarrb: "\u21E5", - RightArrowBar: "\u21E5" -}; -var SHAPES = { - square: "\u25A1", - Square: "\u25A1", - squ: "\u25A1", - squf: "\u25AA", - squarf: "\u25AA", - blacksquar: "\u25AA", - blacksquare: "\u25AA", - FilledVerySmallSquare: "\u25AA", - blk34: "\u2593", - blk12: "\u2592", - blk14: "\u2591", - block: "\u2588", - srect: "\u25AD", - rect: "\u25AD", - sdot: "\u22C5", - sdotb: "\u22A1", - dotsquare: "\u22A1", - triangle: "\u25B5", - tri: "\u25B5", - trine: "\u25B5", - utri: "\u25B5", - triangledown: "\u25BF", - dtri: "\u25BF", - tridown: "\u25BF", - triangleleft: "\u25C3", - ltri: "\u25C3", - triangleright: "\u25B9", - rtri: "\u25B9", - blacktriangle: "\u25B4", - utrif: "\u25B4", - blacktriangledown: "\u25BE", - dtrif: "\u25BE", - blacktriangleleft: "\u25C2", - ltrif: "\u25C2", - blacktriangleright: "\u25B8", - rtrif: "\u25B8", - loz: "\u25CA", - lozenge: "\u25CA", - blacklozenge: "\u29EB", - lozf: "\u29EB", - bigcirc: "\u25EF", - xcirc: "\u25EF", - circ: "\u02C6", - Circle: "\u25CB", - cir: "\u25CB", - o: "\u25CB", - bullet: "\u2022", - bull: "\u2022", - hellip: "\u2026", - mldr: "\u2026", - nldr: "\u2025", - boxh: "\u2500", - HorizontalLine: "\u2500", - boxv: "\u2502", - boxdr: "\u250C", - boxdl: "\u2510", - boxur: "\u2514", - boxul: "\u2518", - boxvr: "\u251C", - boxvl: "\u2524", - boxhd: "\u252C", - boxhu: "\u2534", - boxvh: "\u253C", - boxH: "\u2550", - boxV: "\u2551", - boxdR: "\u2552", - boxDr: "\u2553", - boxDR: "\u2554", - boxDl: "\u2555", - boxdL: "\u2556", - boxDL: "\u2557", - boxuR: "\u2558", - boxUr: "\u2559", - boxUR: "\u255A", - boxUl: "\u255C", - boxuL: "\u255B", - boxUL: "\u255D", - boxvR: "\u255E", - boxVr: "\u255F", - boxVR: "\u2560", - boxVl: "\u2562", - boxvL: "\u2561", - boxVL: "\u2563", - boxHd: "\u2564", - boxhD: "\u2565", - boxHD: "\u2566", - boxHu: "\u2567", - boxhU: "\u2568", - boxHU: "\u2569", - boxvH: "\u256A", - boxVh: "\u256B", - boxVH: "\u256C" -}; -var PUNCTUATION = { - excl: "!", - iexcl: "\xA1", - brvbar: "\xA6", - sect: "\xA7", - uml: "\xA8", - copy: "\xA9", - ordf: "\xAA", - laquo: "\xAB", - not: "\xAC", - shy: "\xAD", - reg: "\xAE", - macr: "\xAF", - deg: "\xB0", - plusmn: "\xB1", - sup2: "\xB2", - sup3: "\xB3", - acute: "\xB4", - micro: "\xB5", - para: "\xB6", - middot: "\xB7", - cedil: "\xB8", - sup1: "\xB9", - ordm: "\xBA", - raquo: "\xBB", - frac14: "\xBC", - frac12: "\xBD", - frac34: "\xBE", - iquest: "\xBF", - nbsp: "\xA0", - comma: ",", - period: ".", - colon: ":", - semi: ";", - vert: "|", - Verbar: "\u2016", - verbar: "|", - dblac: "\u02DD", - circ: "\u02C6", - caron: "\u02C7", - breve: "\u02D8", - dot: "\u02D9", - ring: "\u02DA", - ogon: "\u02DB", - tilde: "\u02DC", - DiacriticalGrave: "`", - DiacriticalAcute: "\xB4", - DiacriticalTilde: "\u02DC", - DiacriticalDot: "\u02D9", - DiacriticalDoubleAcute: "\u02DD", - grave: "`" -}; var CURRENCY = { cent: "\xA2", pound: "\xA3", @@ -47432,106 +46669,6 @@ var CURRENCY = { yuan: "\xA5", cedil: "\xB8" }; -var FRACTIONS = { - frac12: "\xBD", - half: "\xBD", - frac13: "\u2153", - frac14: "\xBC", - frac15: "\u2155", - frac16: "\u2159", - frac18: "\u215B", - frac23: "\u2154", - frac25: "\u2156", - frac34: "\xBE", - frac35: "\u2157", - frac38: "\u215C", - frac45: "\u2158", - frac56: "\u215A", - frac58: "\u215D", - frac78: "\u215E", - frasl: "\u2044" -}; -var MISC_SYMBOLS = { - trade: "\u2122", - TRADE: "\u2122", - telrec: "\u2315", - target: "\u2316", - ulcorn: "\u231C", - ulcorner: "\u231C", - urcorn: "\u231D", - urcorner: "\u231D", - dlcorn: "\u231E", - llcorner: "\u231E", - drcorn: "\u231F", - lrcorner: "\u231F", - intercal: "\u22BA", - intcal: "\u22BA", - oplus: "\u2295", - CirclePlus: "\u2295", - ominus: "\u2296", - CircleMinus: "\u2296", - otimes: "\u2297", - CircleTimes: "\u2297", - osol: "\u2298", - odot: "\u2299", - CircleDot: "\u2299", - oast: "\u229B", - circledast: "\u229B", - odash: "\u229D", - circleddash: "\u229D", - ocirc: "\u229A", - circledcirc: "\u229A", - boxplus: "\u229E", - plusb: "\u229E", - boxminus: "\u229F", - minusb: "\u229F", - boxtimes: "\u22A0", - timesb: "\u22A0", - boxdot: "\u22A1", - sdotb: "\u22A1", - veebar: "\u22BB", - vee: "\u2228", - barvee: "\u22BD", - and: "\u2227", - wedge: "\u2227", - Cap: "\u22D2", - Cup: "\u22D3", - Fork: "\u22D4", - pitchfork: "\u22D4", - epar: "\u22D5", - ltlarr: "\u2976", - nvap: "\u224D\u20D2", - nvsim: "\u223C\u20D2", - nvge: "\u2265\u20D2", - nvle: "\u2264\u20D2", - nvlt: "<\u20D2", - nvgt: ">\u20D2", - nvltrie: "\u22B4\u20D2", - nvrtrie: "\u22B5\u20D2", - Vdash: "\u22A9", - dashv: "\u22A3", - vDash: "\u22A8", - Vvdash: "\u22AA", - nvdash: "\u22AC", - nvDash: "\u22AD", - nVdash: "\u22AE", - nVDash: "\u22AF" -}; -var ALL_ENTITIES = { - ...BASIC_LATIN, - ...LATIN_ACCENTS, - ...LATIN_EXTENDED, - ...GREEK, - ...CYRILLIC, - ...MATH, - ...MATH_ADVANCED, - ...ARROWS, - ...SHAPES, - ...PUNCTUATION, - ...CURRENCY, - ...FRACTIONS, - ...MISC_SYMBOLS -}; var XML = { amp: "&", apos: "'", @@ -48175,7 +47312,7 @@ var XmlNode = class { } }; -// node_modules/xml-naming/src/index.js +// node_modules/fast-xml-parser/node_modules/xml-naming/src/index.js var nameStartChar10 = ":A-Za-z_\xC0-\xD6\xD8-\xF6\xF8-\u02FF\u0370-\u037D\u037F-\u0486\u0488-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD"; var nameChar10 = nameStartChar10 + "\\-\\.\\d\xB7\u0300-\u036F\u203F-\u2040"; var nameStartChar11 = ":A-Za-z_\xC0-\u02FF\u0370-\u037D\u037F-\u0486\u0488-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\u{10000}-\u{EFFFF}"; @@ -48194,8 +47331,14 @@ var buildRegexes = (startChar, char, flags = "") => { }; var regexes10 = buildRegexes(nameStartChar10, nameChar10); var regexes11 = buildRegexes(nameStartChar11, nameChar11, "u"); -var getRegexes = (xmlVersion = "1.0") => xmlVersion === "1.1" ? regexes11 : regexes10; -var qName = (str, { xmlVersion = "1.0" } = {}) => getRegexes(xmlVersion).qName.test(str); +var nameStartCharAscii = ":A-Za-z_"; +var nameCharAscii = nameStartCharAscii + "\\-\\.\\d"; +var regexesAscii = buildRegexes(nameStartCharAscii, nameCharAscii); +var getRegexes = (xmlVersion = "1.0", asciiOnly = false) => { + if (asciiOnly) return regexesAscii; + return xmlVersion === "1.1" ? regexes11 : regexes10; +}; +var qName = (str, { xmlVersion = "1.0", asciiOnly = false } = {}) => getRegexes(xmlVersion, asciiOnly).qName.test(str); // node_modules/fast-xml-parser/src/xmlparser/DocTypeReader.js var DocTypeReader = class { @@ -50024,27 +49167,6 @@ var SQL_PATTERNS = [ ]; var sql_default = SQL_PATTERNS; -// node_modules/is-unsafe/src/contexts/sql-strict.js -var SQL_STRICT_EXTRA = [ - { - id: "sql-line-comment", - description: "SQL line comment: -- followed by whitespace or end of string", - pattern: /--(?:\s|$)/ - }, - { - id: "sql-stacked-query", - description: "Stacked queries: semicolon immediately followed by a SQL keyword", - pattern: /;\s{0,10}(?:SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC)\b/i - }, - { - id: "sql-hex-encoding", - description: "Hex-encoded string injection: 0x41414141 style (MySQL)", - pattern: /\b0x[0-9a-f]{4,}/i - } -]; -var SQL_STRICT_PATTERNS = [...sql_default, ...SQL_STRICT_EXTRA]; -var sql_strict_default = SQL_STRICT_PATTERNS; - // node_modules/is-unsafe/src/contexts/shell.js var SHELL_PATTERNS = [ { @@ -50356,8 +49478,38 @@ var LOG_PATTERNS = [ ]; var log_default = LOG_PATTERNS; -// node_modules/is-unsafe/src/registry.js -var CONTEXT_REGISTRY = { +// node_modules/is-unsafe/src/contexts/sql-strict.js +var SQL_STRICT_EXTRA = [ + { + id: "sql-line-comment", + description: "SQL line comment: -- followed by whitespace or end of string", + pattern: /--(?:\s|$)/ + }, + { + id: "sql-stacked-query", + description: "Stacked queries: semicolon immediately followed by a SQL keyword", + pattern: /;\s{0,10}(?:SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC)\b/i + }, + { + id: "sql-hex-encoding", + description: "Hex-encoded string injection: 0x41414141 style (MySQL)", + pattern: /\b0x[0-9a-f]{4,}/i + } +]; +var SQL_STRICT_PATTERNS = [...sql_default, ...SQL_STRICT_EXTRA]; +var sql_strict_default = SQL_STRICT_PATTERNS; + +// node_modules/is-unsafe/src/index.js +html_default.label = "HTML"; +xml_default.label = "XML"; +svg_default.label = "SVG"; +sql_default.label = "SQL"; +sql_strict_default.label = "SQL-STRICT"; +shell_default.label = "SHELL"; +redos_default.label = "REDOS"; +nosql_default.label = "NOSQL"; +log_default.label = "LOG"; +var VALID_CONTEXTS = Object.freeze({ HTML: html_default, XML: xml_default, SVG: svg_default, @@ -50367,13 +49519,7 @@ var CONTEXT_REGISTRY = { REDOS: redos_default, NOSQL: nosql_default, LOG: log_default -}; -var registry_default = CONTEXT_REGISTRY; -var VALID_CONTEXTS = Object.freeze( - Object.fromEntries(Object.keys(CONTEXT_REGISTRY).map((k) => [k, k])) -); - -// node_modules/is-unsafe/src/index.js +}); function assertString(value) { if (typeof value !== "string") { throw new TypeError( @@ -50383,36 +49529,35 @@ function assertString(value) { } function assertContext(context3) { if (context3 instanceof RegExp) return; - if (typeof context3 === "string") { - if (!registry_default[context3]) { - throw new TypeError( - `is-unsafe: unknown context "${context3}". Valid contexts: ${Object.keys(VALID_CONTEXTS).join(", ")}` - ); - } - return; - } if (Array.isArray(context3)) { if (context3.length === 0) { - throw new TypeError("is-unsafe: context array must not be empty"); + throw new TypeError("is-unsafe: context must not be an empty array"); } - for (const c of context3) { - if (typeof c !== "string" || !registry_default[c]) { - throw new TypeError( - `is-unsafe: unknown context "${c}" in array. Valid contexts: ${Object.keys(VALID_CONTEXTS).join(", ")}` - ); + if (Array.isArray(context3[0])) { + for (const list of context3) { + if (!Array.isArray(list) || list.length === 0) { + throw new TypeError( + "is-unsafe: each context in the array must be a non-empty pattern array (PatternList)" + ); + } } } return; } throw new TypeError( - `is-unsafe: second argument must be a context string, array of context strings, or RegExp. Got: ${typeof context3}` + `is-unsafe: second argument must be a PatternList (e.g. HTML), an array of PatternLists (e.g. [HTML, XML]), or a RegExp. Got: ${typeof context3}` ); } -function matchContext(value, contextName) { - const patterns = registry_default[contextName]; - for (const rule of patterns) { +function normalise(context3) { + if (context3 instanceof RegExp) return { lists: null, regex: context3 }; + if (Array.isArray(context3[0])) return { lists: context3, regex: null }; + return { lists: [context3], regex: null }; +} +function matchList(value, list) { + const label = list.label ?? "CUSTOM"; + for (const rule of list) { if (rule.pattern.test(value)) { - return { context: contextName, id: rule.id, description: rule.description, pattern: rule.pattern }; + return { context: label, id: rule.id, description: rule.description, pattern: rule.pattern }; } } return null; @@ -50420,14 +49565,10 @@ function matchContext(value, contextName) { function isUnsafe(value, context3) { assertString(value); assertContext(context3); - if (context3 instanceof RegExp) { - return context3.test(value); - } - if (typeof context3 === "string") { - return matchContext(value, context3) !== null; - } - for (const c of context3) { - if (matchContext(value, c) !== null) return true; + const { lists, regex } = normalise(context3); + if (regex) return regex.test(value); + for (const list of lists) { + if (matchList(value, list) !== null) return true; } return false; } @@ -50476,6 +49617,7 @@ var OrderedObjParser = class { this.ignoreAttributesFn = getIgnoreAttributesFn(this.options.ignoreAttributes); this.entityExpansionCount = 0; this.currentExpandedLength = 0; + this.doctypefound = false; let namedEntities = { ...XML }; if (this.options.entityDecoder) { this.entityDecoder = this.options.entityDecoder; @@ -50493,7 +49635,7 @@ var OrderedObjParser = class { // onExternalEntity: (name, value) => isUnsafe(value) ? 'block' : 'allow', onInputEntity: (name, value) => ( //TODO: VALID_CONTEXTS.HTML should be set only if this.options.htmlEntities - isUnsafe(value, [VALID_CONTEXTS.HTML, VALID_CONTEXTS.XML]) ? ENTITY_ACTION.BLOCK : ENTITY_ACTION.ALLOW + isUnsafe(value, [html_default, xml_default]) ? ENTITY_ACTION.BLOCK : ENTITY_ACTION.ALLOW ) //postCheck: resolved => resolved }); @@ -50627,6 +49769,7 @@ var parseXml = function(xmlData) { this.entityDecoder.reset(); this.entityExpansionCount = 0; this.currentExpandedLength = 0; + this.doctypefound = false; const options = this.options; const docTypeReader = new DocTypeReader(options.processEntities); const xmlLen = xmlData.length; @@ -50689,6 +49832,8 @@ var parseXml = function(xmlData) { } i = endIndex; } else if (c1 === 33 && xmlData.charCodeAt(i + 2) === 68) { + if (this.doctypefound) throw new Error("Multiple DOCTYPE declarations found."); + this.doctypefound = true; const result = docTypeReader.readDocType(xmlData, i); this.entityDecoder.addInputEntities(result.entities); i = result.i; @@ -51201,6 +50346,28 @@ function escapeAttribute(val) { return String(val).replace(/"/g, """).replace(/'/g, "'"); } +// node_modules/xml-naming/src/index.js +var nameStartChar102 = ":A-Za-z_\xC0-\xD6\xD8-\xF6\xF8-\u02FF\u0370-\u037D\u037F-\u0486\u0488-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD"; +var nameChar102 = nameStartChar102 + "\\-\\.\\d\xB7\u0300-\u036F\u203F-\u2040"; +var nameStartChar112 = ":A-Za-z_\xC0-\u02FF\u0370-\u037D\u037F-\u0486\u0488-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\u{10000}-\u{EFFFF}"; +var nameChar112 = nameStartChar112 + "\\-\\.\\d\xB7\u0300-\u036F\u0487\u203F-\u2040"; +var buildRegexes2 = (startChar, char, flags = "") => { + const ncStart = startChar.replace(":", ""); + const ncChar = char.replace(":", ""); + const ncNamePat = `[${ncStart}][${ncChar}]*`; + return { + name: new RegExp(`^[${startChar}][${char}]*$`, flags), + ncName: new RegExp(`^${ncNamePat}$`, flags), + qName: new RegExp(`^${ncNamePat}(?::${ncNamePat})?$`, flags), + nmToken: new RegExp(`^[${char}]+$`, flags), + nmTokens: new RegExp(`^[${char}]+(?:\\s+[${char}]+)*$`, flags) + }; +}; +var regexes102 = buildRegexes2(nameStartChar102, nameChar102); +var regexes112 = buildRegexes2(nameStartChar112, nameChar112, "u"); +var getRegexes2 = (xmlVersion = "1.0") => xmlVersion === "1.1" ? regexes112 : regexes102; +var qName2 = (str, { xmlVersion = "1.0" } = {}) => getRegexes2(xmlVersion).qName.test(str); + // node_modules/fast-xml-builder/src/orderedJs2Xml.js var EOL6 = "\n"; function detectXmlVersionFromArray(jArray, options) { @@ -51218,7 +50385,7 @@ function detectXmlVersionFromArray(jArray, options) { } function resolveTagName(name, isAttribute2, options, matcher, xmlVersion) { if (!options.sanitizeName) return name; - if (qName(name, { xmlVersion })) return name; + if (qName2(name, { xmlVersion })) return name; return options.sanitizeName(name, { isAttribute: isAttribute2, matcher: matcher.readOnly() }); } function toXml(jArray, options) { @@ -51563,7 +50730,7 @@ function detectXmlVersionFromObj(jObj, options) { } function resolveTagName2(name, isAttribute2, options, matcher, xmlVersion) { if (!options.sanitizeName) return name; - if (qName(name, { xmlVersion })) return name; + if (qName2(name, { xmlVersion })) return name; return options.sanitizeName(name, { isAttribute: isAttribute2, matcher: matcher.readOnly() }); } Builder.prototype.build = function(jObj) { From 8fa78b3b5f6a2e219df15d842ff24b9cfc65e0b4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 14:26:15 +0000 Subject: [PATCH 2/4] fix: apply audit fixes --- dist/setup/index.cjs | 1497 ++++++++++-------------------------------- 1 file changed, 332 insertions(+), 1165 deletions(-) diff --git a/dist/setup/index.cjs b/dist/setup/index.cjs index 2a9b198..6e40175 100644 --- a/dist/setup/index.cjs +++ b/dist/setup/index.cjs @@ -1928,7 +1928,11 @@ var require_request = __commonJS({ } else if (typeof val[i] === "object") { throw new InvalidArgumentError(`invalid ${key} header`); } else { - arr.push(`${val[i]}`); + const str = `${val[i]}`; + if (!isValidHeaderValue(str)) { + throw new InvalidArgumentError(`invalid ${key} header`); + } + arr.push(str); } } val = arr; @@ -1940,6 +1944,9 @@ var require_request = __commonJS({ val = ""; } else { val = `${val}`; + if (!isValidHeaderValue(val)) { + throw new InvalidArgumentError(`invalid ${key} header`); + } } if (headerName === "host") { if (request.host !== null) { @@ -5670,6 +5677,7 @@ var require_client_h1 = __commonJS({ RequestContentLengthMismatchError, ResponseContentLengthMismatchError, RequestAbortedError, + InvalidArgumentError, HeadersTimeoutError, HeadersOverflowError, SocketError, @@ -6396,8 +6404,16 @@ var require_client_h1 = __commonJS({ } body2 = bodyStream.stream; contentLength2 = bodyStream.length; - } else if (util10.isBlobLike(body2) && request.contentType == null && body2.type) { - headers.push("content-type", body2.type); + } else if (util10.isBlobLike(body2) && request.contentType == null) { + const contentType2 = body2.type; + if (contentType2) { + const contentTypeValue = `${contentType2}`; + if (!util10.isValidHeaderValue(contentTypeValue)) { + util10.errorRequest(client, request, new InvalidArgumentError("invalid content-type header")); + return false; + } + headers.push("content-type", contentTypeValue); + } } if (body2 && typeof body2.read === "function") { body2.read(0); @@ -8949,6 +8965,24 @@ var require_retry_handler = __commonJS({ const current = Date.now(); return new Date(retryAfter).getTime() - current; } + function validatePartialResponseContentLength(headers, range3, statusCode, retryCount) { + const contentLength2 = headers["content-length"]; + if (contentLength2 == null) { + return null; + } + if (!Number.isFinite(range3.start) || !Number.isFinite(range3.end)) { + return null; + } + const length = Number(contentLength2); + const expectedLength = range3.end - range3.start + 1; + if (!Number.isFinite(length) || length !== expectedLength) { + return new RequestRetryError("Content-Length mismatch", statusCode, { + headers, + data: { count: retryCount } + }); + } + return null; + } var RetryHandler = class _RetryHandler { constructor(opts, handlers) { const { retryOptions, ...dispatchOpts } = opts; @@ -9121,6 +9155,11 @@ var require_retry_handler = __commonJS({ ); return false; } + const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount); + if (contentLengthError != null) { + this.abort(contentLengthError); + return false; + } const { start, size, end = size - 1 } = contentRange; assert4(this.start === start, "content-range mismatch"); assert4(this.end == null || this.end === end, "content-range mismatch"); @@ -9138,6 +9177,11 @@ var require_retry_handler = __commonJS({ statusMessage ); } + const contentLengthError = validatePartialResponseContentLength(headers, range3, statusCode, this.retryCount); + if (contentLengthError != null) { + this.abort(contentLengthError); + return false; + } const { start, size, end = size - 1 } = range3; assert4( start != null && Number.isFinite(start), @@ -15983,14 +16027,48 @@ var require_util6 = __commonJS({ for (let i = 0; i < path18.length; ++i) { const code = path18.charCodeAt(i); if (code < 32 || // exclude CTLs (0-31) - code === 127 || // DEL + code > 126 || // exclude DEL and non-ascii code === 59) { throw new Error("Invalid cookie path"); } } } + function isLetterOrDigit(code) { + return code >= 48 && code <= 57 || // 0-9 + code >= 65 && code <= 90 || // A-Z + code >= 97 && code <= 122; + } function validateCookieDomain(domain) { - if (domain.startsWith("-") || domain.endsWith(".") || domain.endsWith("-")) { + if (domain === " ") { + return; + } + if (domain.length > 255) { + throw new Error("Invalid cookie domain"); + } + let labelLength = 0; + for (let i = 0; i < domain.length; ++i) { + const code = domain.charCodeAt(i); + if (code === 46) { + if (labelLength === 0) { + throw new Error("Invalid cookie domain"); + } + if (domain.charCodeAt(i - 1) === 45) { + throw new Error("Invalid cookie domain"); + } + labelLength = 0; + continue; + } + if (labelLength === 0 && !isLetterOrDigit(code)) { + throw new Error("Invalid cookie domain"); + } + if (!isLetterOrDigit(code) && code !== 45) { + throw new Error("Invalid cookie domain"); + } + if (++labelLength > 63) { + throw new Error("Invalid cookie domain"); + } + } + if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 45) { throw new Error("Invalid cookie domain"); } } @@ -16073,7 +16151,11 @@ var require_util6 = __commonJS({ throw new Error("Invalid unparsed"); } const [key, ...value] = part.split("="); - out.push(`${key.trim()}=${value.join("=")}`); + const trimmedKey = key.trim(); + const joinedValue = value.join("="); + validateCookieName(trimmedKey); + validateCookieValue(joinedValue); + out.push(`${trimmedKey}=${joinedValue}`); } return out.join("; "); } @@ -18833,6 +18915,8 @@ var require_brace_expansion = __commonJS({ var escClose2 = "\0CLOSE" + Math.random() + "\0"; var escComma2 = "\0COMMA" + Math.random() + "\0"; var escPeriod2 = "\0PERIOD" + Math.random() + "\0"; + var EXPANSION_MAX2 = 1e5; + var EXPANSION_MAX_LENGTH2 = 4e6; function numeric2(str) { return parseInt(str, 10) == str ? parseInt(str, 10) : str.charCodeAt(0); } @@ -18866,11 +18950,12 @@ var require_brace_expansion = __commonJS({ if (!str) return []; options = options || {}; - var max = options.max == null ? Infinity : options.max; + var max = options.max == null ? EXPANSION_MAX2 : options.max; + var maxLength = options.maxLength == null ? EXPANSION_MAX_LENGTH2 : options.maxLength; if (str.substr(0, 2) === "{}") { str = "\\{\\}" + str.substr(2); } - return expand2(escapeBraces2(str), max, true).map(unescapeBraces2); + return expand2(escapeBraces2(str), max, maxLength, true).map(unescapeBraces2); } function embrace2(str) { return "{" + str + "}"; @@ -18884,11 +18969,82 @@ var require_brace_expansion = __commonJS({ function gte2(i, y) { return i >= y; } - function expand2(str, max, isTop) { - var expansions = []; + function combine2(acc, base, pre, values, max, maxLength, dropEmpties, outBase) { + var out = []; + var length = 0; + for (var a = 0; a < acc.length; a++) { + for (var v = 0; v < values.length; v++) { + if (out.length >= max) return out; + var expansion = acc[a] + pre + values[v]; + if (dropEmpties && expansion.length === base[a]) continue; + if (length + expansion.length > maxLength) return out; + out.push(expansion); + outBase.push(base[a]); + length += expansion.length; + } + } + return out; + } + function expandSequence2(body2, isAlphaSequence, max, maxLength) { + var n = body2.split(/\.\./); + var N = []; + if (n[0] === void 0 || n[1] === void 0) { + return N; + } + var x = numeric2(n[0]); + var y = numeric2(n[1]); + var width = Math.max(n[0].length, n[1].length); + var incr = n.length === 3 && n[2] !== void 0 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; + var test2 = lte2; + var reverse = y < x; + if (reverse) { + incr *= -1; + test2 = gte2; + } + var pad = n.some(isPadded2); + var length = 0; + for (var i = x; test2(i, y) && N.length < max; i += incr) { + var c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === "\\") { + c = ""; + } + } else { + c = String(i); + if (pad) { + var need = width - c.length; + if (need > 0) { + var z = new Array(need + 1).join("0"); + if (i < 0) { + c = "-" + z + c.slice(1); + } else { + c = z + c; + } + } + } + } + if (length + c.length > maxLength) break; + N.push(c); + length += c.length; + } + return N; + } + function expand2(str, max, maxLength, isTop) { + var acc = [""]; + var accBase = [0]; + var dropEmpties = false; + var firstGroup = true; + var nextBase; for (; ; ) { var m = balanced2("{", "}", str); - if (!m || /\$$/.test(m.pre)) return [str]; + if (!m) { + return combine2(acc, accBase, str, [""], max, maxLength, dropEmpties, []); + } + var pre = m.pre; + if (/\$$/.test(pre)) { + return combine2(acc, accBase, str, [""], max, maxLength, dropEmpties, []); + } var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); var isSequence = isNumericSequence || isAlphaSequence; @@ -18897,76 +19053,91 @@ var require_brace_expansion = __commonJS({ if (m.post.match(/,(?!,).*\}/)) { str = m.pre + "{" + m.body + escClose2 + m.post; isTop = true; + firstGroup = true; + dropEmpties = false; + accBase = []; + for (var b = 0; b < acc.length; b++) { + accBase.push(acc[b].length); + } continue; } - return [str]; + return combine2( + acc, + accBase, + pre + "{" + m.body + "}" + m.post, + [""], + max, + maxLength, + dropEmpties, + [] + ); + } + if (firstGroup) { + dropEmpties = isTop && !isSequence; + firstGroup = false; } - var n; + var values; if (isSequence) { - n = m.body.split(/\.\./); + values = expandSequence2(m.body, isAlphaSequence, max, maxLength); } else { - n = parseCommaParts2(m.body); - if (n.length === 1) { - n = expand2(n[0], max, false).map(embrace2); + var n = parseCommaParts2(m.body); + if (n.length === 1 && n[0] !== void 0) { + n = expand2(n[0], max, maxLength, false).map(embrace2); if (n.length === 1) { - var post = m.post.length ? expand2(m.post, max, false) : [""]; - return post.map(function(p) { - return m.pre + n[0] + p; - }); + nextBase = []; + acc = combine2( + acc, + accBase, + pre + n[0], + [""], + max, + maxLength, + dropEmpties && !m.post.length, + nextBase + ); + accBase = nextBase; + if (!m.post.length) break; + str = m.post; + continue; } } - } - var pre = m.pre; - var post = m.post.length ? expand2(m.post, max, false) : [""]; - var N; - if (isSequence) { - var x = numeric2(n[0]); - var y = numeric2(n[1]); - var width = Math.max(n[0].length, n[1].length); - var incr = n.length == 3 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; - var test2 = lte2; - var reverse = y < x; - if (reverse) { - incr *= -1; - test2 = gte2; - } - var pad = n.some(isPadded2); - N = []; - for (var i = x; test2(i, y) && N.length < max; i += incr) { - var c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === "\\") - c = ""; - } else { - c = String(i); - if (pad) { - var need = width - c.length; - if (need > 0) { - var z = new Array(need + 1).join("0"); - if (i < 0) - c = "-" + z + c.slice(1); - else - c = z + c; - } - } + var dropsEmpties = dropEmpties && !m.post.length && !pre; + for (var d = 0; dropsEmpties && d < acc.length; d++) { + if (acc[d].length !== accBase[d]) { + dropsEmpties = false; } - N.push(c); } - } else { - N = concatMap(n, function(el) { - return expand2(el, max, false); - }); - } - for (var j = 0; j < N.length; j++) { - for (var k = 0; k < post.length && expansions.length < max; k++) { - var expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) - expansions.push(expansion); + values = []; + var valuesLength = 0; + outer: for (var j = 0; j < n.length; j++) { + var expanded = expand2(n[j], max, maxLength, false); + for (var k = 0; k < expanded.length; k++) { + var v = expanded[k]; + if (dropsEmpties && !v) continue; + if (values.length >= max || valuesLength + v.length > maxLength) { + break outer; + } + values.push(v); + valuesLength += v.length; + } } } - return expansions; + nextBase = []; + acc = combine2( + acc, + accBase, + pre, + values, + max, + maxLength, + dropEmpties && !m.post.length, + nextBase + ); + accBase = nextBase; + if (!m.post.length) break; + str = m.post; } + return acc; } } }); @@ -75950,940 +76121,6 @@ function getPositionFromMatch(match4) { } // node_modules/@nodable/entities/src/entities.js -var BASIC_LATIN = { - amp: "&", - AMP: "&", - lt: "<", - LT: "<", - gt: ">", - GT: ">", - quot: '"', - QUOT: '"', - apos: "'", - lsquo: "\u2018", - rsquo: "\u2019", - ldquo: "\u201C", - rdquo: "\u201D", - lsquor: "\u201A", - rsquor: "\u2019", - ldquor: "\u201E", - bdquo: "\u201E", - comma: ",", - period: ".", - colon: ":", - semi: ";", - excl: "!", - quest: "?", - num: "#", - dollar: "$", - percent: "%", - ast: "*", - commat: "@", - lowbar: "_", - verbar: "|", - vert: "|", - sol: "/", - bsol: "\\", - lbrace: "{", - rbrace: "}", - lbrack: "[", - rbrack: "]", - lpar: "(", - rpar: ")", - nbsp: "\xA0", - iexcl: "\xA1", - cent: "\xA2", - pound: "\xA3", - curren: "\xA4", - yen: "\xA5", - brvbar: "\xA6", - sect: "\xA7", - uml: "\xA8", - copy: "\xA9", - COPY: "\xA9", - ordf: "\xAA", - laquo: "\xAB", - not: "\xAC", - shy: "\xAD", - reg: "\xAE", - REG: "\xAE", - macr: "\xAF", - deg: "\xB0", - plusmn: "\xB1", - sup2: "\xB2", - sup3: "\xB3", - acute: "\xB4", - micro: "\xB5", - para: "\xB6", - middot: "\xB7", - cedil: "\xB8", - sup1: "\xB9", - ordm: "\xBA", - raquo: "\xBB", - frac14: "\xBC", - frac12: "\xBD", - half: "\xBD", - frac34: "\xBE", - iquest: "\xBF", - times: "\xD7", - div: "\xF7", - divide: "\xF7" -}; -var LATIN_ACCENTS = { - Agrave: "\xC0", - agrave: "\xE0", - Aacute: "\xC1", - aacute: "\xE1", - Acirc: "\xC2", - acirc: "\xE2", - Atilde: "\xC3", - atilde: "\xE3", - Auml: "\xC4", - auml: "\xE4", - Aring: "\xC5", - aring: "\xE5", - AElig: "\xC6", - aelig: "\xE6", - Ccedil: "\xC7", - ccedil: "\xE7", - Egrave: "\xC8", - egrave: "\xE8", - Eacute: "\xC9", - eacute: "\xE9", - Ecirc: "\xCA", - ecirc: "\xEA", - Euml: "\xCB", - euml: "\xEB", - Igrave: "\xCC", - igrave: "\xEC", - Iacute: "\xCD", - iacute: "\xED", - Icirc: "\xCE", - icirc: "\xEE", - Iuml: "\xCF", - iuml: "\xEF", - ETH: "\xD0", - eth: "\xF0", - Ntilde: "\xD1", - ntilde: "\xF1", - Ograve: "\xD2", - ograve: "\xF2", - Oacute: "\xD3", - oacute: "\xF3", - Ocirc: "\xD4", - ocirc: "\xF4", - Otilde: "\xD5", - otilde: "\xF5", - Ouml: "\xD6", - ouml: "\xF6", - Oslash: "\xD8", - oslash: "\xF8", - Ugrave: "\xD9", - ugrave: "\xF9", - Uacute: "\xDA", - uacute: "\xFA", - Ucirc: "\xDB", - ucirc: "\xFB", - Uuml: "\xDC", - uuml: "\xFC", - Yacute: "\xDD", - yacute: "\xFD", - THORN: "\xDE", - thorn: "\xFE", - szlig: "\xDF", - yuml: "\xFF", - Yuml: "\u0178" -}; -var LATIN_EXTENDED = { - Amacr: "\u0100", - amacr: "\u0101", - Abreve: "\u0102", - abreve: "\u0103", - Aogon: "\u0104", - aogon: "\u0105", - Cacute: "\u0106", - cacute: "\u0107", - Ccirc: "\u0108", - ccirc: "\u0109", - Cdot: "\u010A", - cdot: "\u010B", - Ccaron: "\u010C", - ccaron: "\u010D", - Dcaron: "\u010E", - dcaron: "\u010F", - Dstrok: "\u0110", - dstrok: "\u0111", - Emacr: "\u0112", - emacr: "\u0113", - Ecaron: "\u011A", - ecaron: "\u011B", - Edot: "\u0116", - edot: "\u0117", - Eogon: "\u0118", - eogon: "\u0119", - Gcirc: "\u011C", - gcirc: "\u011D", - Gbreve: "\u011E", - gbreve: "\u011F", - Gdot: "\u0120", - gdot: "\u0121", - Gcedil: "\u0122", - Hcirc: "\u0124", - hcirc: "\u0125", - Hstrok: "\u0126", - hstrok: "\u0127", - Itilde: "\u0128", - itilde: "\u0129", - Imacr: "\u012A", - imacr: "\u012B", - Iogon: "\u012E", - iogon: "\u012F", - Idot: "\u0130", - IJlig: "\u0132", - ijlig: "\u0133", - Jcirc: "\u0134", - jcirc: "\u0135", - Kcedil: "\u0136", - kcedil: "\u0137", - kgreen: "\u0138", - Lacute: "\u0139", - lacute: "\u013A", - Lcedil: "\u013B", - lcedil: "\u013C", - Lcaron: "\u013D", - lcaron: "\u013E", - Lmidot: "\u013F", - lmidot: "\u0140", - Lstrok: "\u0141", - lstrok: "\u0142", - Nacute: "\u0143", - nacute: "\u0144", - Ncaron: "\u0147", - ncaron: "\u0148", - Ncedil: "\u0145", - ncedil: "\u0146", - ENG: "\u014A", - eng: "\u014B", - Omacr: "\u014C", - omacr: "\u014D", - Odblac: "\u0150", - odblac: "\u0151", - OElig: "\u0152", - oelig: "\u0153", - Racute: "\u0154", - racute: "\u0155", - Rcaron: "\u0158", - rcaron: "\u0159", - Rcedil: "\u0156", - rcedil: "\u0157", - Sacute: "\u015A", - sacute: "\u015B", - Scirc: "\u015C", - scirc: "\u015D", - Scedil: "\u015E", - scedil: "\u015F", - Scaron: "\u0160", - scaron: "\u0161", - Tcedil: "\u0162", - tcedil: "\u0163", - Tcaron: "\u0164", - tcaron: "\u0165", - Tstrok: "\u0166", - tstrok: "\u0167", - Utilde: "\u0168", - utilde: "\u0169", - Umacr: "\u016A", - umacr: "\u016B", - Ubreve: "\u016C", - ubreve: "\u016D", - Uring: "\u016E", - uring: "\u016F", - Udblac: "\u0170", - udblac: "\u0171", - Uogon: "\u0172", - uogon: "\u0173", - Wcirc: "\u0174", - wcirc: "\u0175", - Ycirc: "\u0176", - ycirc: "\u0177", - Zacute: "\u0179", - zacute: "\u017A", - Zdot: "\u017B", - zdot: "\u017C", - Zcaron: "\u017D", - zcaron: "\u017E" -}; -var GREEK = { - Alpha: "\u0391", - alpha: "\u03B1", - Beta: "\u0392", - beta: "\u03B2", - Gamma: "\u0393", - gamma: "\u03B3", - Delta: "\u0394", - delta: "\u03B4", - Epsilon: "\u0395", - epsilon: "\u03B5", - epsiv: "\u03F5", - varepsilon: "\u03F5", - Zeta: "\u0396", - zeta: "\u03B6", - Eta: "\u0397", - eta: "\u03B7", - Theta: "\u0398", - theta: "\u03B8", - thetasym: "\u03D1", - vartheta: "\u03D1", - Iota: "\u0399", - iota: "\u03B9", - Kappa: "\u039A", - kappa: "\u03BA", - kappav: "\u03F0", - varkappa: "\u03F0", - Lambda: "\u039B", - lambda: "\u03BB", - Mu: "\u039C", - mu: "\u03BC", - Nu: "\u039D", - nu: "\u03BD", - Xi: "\u039E", - xi: "\u03BE", - Omicron: "\u039F", - omicron: "\u03BF", - Pi: "\u03A0", - pi: "\u03C0", - piv: "\u03D6", - varpi: "\u03D6", - Rho: "\u03A1", - rho: "\u03C1", - rhov: "\u03F1", - varrho: "\u03F1", - Sigma: "\u03A3", - sigma: "\u03C3", - sigmaf: "\u03C2", - sigmav: "\u03C2", - varsigma: "\u03C2", - Tau: "\u03A4", - tau: "\u03C4", - Upsilon: "\u03A5", - upsilon: "\u03C5", - upsi: "\u03C5", - Upsi: "\u03D2", - upsih: "\u03D2", - Phi: "\u03A6", - phi: "\u03C6", - phiv: "\u03D5", - varphi: "\u03D5", - Chi: "\u03A7", - chi: "\u03C7", - Psi: "\u03A8", - psi: "\u03C8", - Omega: "\u03A9", - omega: "\u03C9", - ohm: "\u03A9", - Gammad: "\u03DC", - gammad: "\u03DD", - digamma: "\u03DD" -}; -var CYRILLIC = { - Afr: "\u{1D504}", - afr: "\u{1D51E}", - Acy: "\u0410", - acy: "\u0430", - Bcy: "\u0411", - bcy: "\u0431", - Vcy: "\u0412", - vcy: "\u0432", - Gcy: "\u0413", - gcy: "\u0433", - Dcy: "\u0414", - dcy: "\u0434", - IEcy: "\u0415", - iecy: "\u0435", - IOcy: "\u0401", - iocy: "\u0451", - ZHcy: "\u0416", - zhcy: "\u0436", - Zcy: "\u0417", - zcy: "\u0437", - Icy: "\u0418", - icy: "\u0438", - Jcy: "\u0419", - jcy: "\u0439", - Kcy: "\u041A", - kcy: "\u043A", - Lcy: "\u041B", - lcy: "\u043B", - Mcy: "\u041C", - mcy: "\u043C", - Ncy: "\u041D", - ncy: "\u043D", - Ocy: "\u041E", - ocy: "\u043E", - Pcy: "\u041F", - pcy: "\u043F", - Rcy: "\u0420", - rcy: "\u0440", - Scy: "\u0421", - scy: "\u0441", - Tcy: "\u0422", - tcy: "\u0442", - Ucy: "\u0423", - ucy: "\u0443", - Fcy: "\u0424", - fcy: "\u0444", - KHcy: "\u0425", - khcy: "\u0445", - TScy: "\u0426", - tscy: "\u0446", - CHcy: "\u0427", - chcy: "\u0447", - SHcy: "\u0428", - shcy: "\u0448", - SHCHcy: "\u0429", - shchcy: "\u0449", - HARDcy: "\u042A", - hardcy: "\u044A", - Ycy: "\u042B", - ycy: "\u044B", - SOFTcy: "\u042C", - softcy: "\u044C", - Ecy: "\u042D", - ecy: "\u044D", - YUcy: "\u042E", - yucy: "\u044E", - YAcy: "\u042F", - yacy: "\u044F", - DJcy: "\u0402", - djcy: "\u0452", - GJcy: "\u0403", - gjcy: "\u0453", - Jukcy: "\u0404", - jukcy: "\u0454", - DScy: "\u0405", - dscy: "\u0455", - Iukcy: "\u0406", - iukcy: "\u0456", - YIcy: "\u0407", - yicy: "\u0457", - Jsercy: "\u0408", - jsercy: "\u0458", - LJcy: "\u0409", - ljcy: "\u0459", - NJcy: "\u040A", - njcy: "\u045A", - TSHcy: "\u040B", - tshcy: "\u045B", - KJcy: "\u040C", - kjcy: "\u045C", - Ubrcy: "\u040E", - ubrcy: "\u045E", - DZcy: "\u040F", - dzcy: "\u045F" -}; -var MATH = { - plus: "+", - pm: "\xB1", - times: "\xD7", - div: "\xF7", - divide: "\xF7", - sdot: "\u22C5", - star: "\u2606", - starf: "\u2605", - bigstar: "\u2605", - lowast: "\u2217", - ast: "*", - midast: "*", - compfn: "\u2218", - smallcircle: "\u2218", - bullet: "\u2022", - bull: "\u2022", - nbsp: "\xA0", - hellip: "\u2026", - mldr: "\u2026", - prime: "\u2032", - Prime: "\u2033", - tprime: "\u2034", - bprime: "\u2035", - backprime: "\u2035", - minus: "\u2212", - minusd: "\u2238", - dotminus: "\u2238", - plusdo: "\u2214", - dotplus: "\u2214", - plusmn: "\xB1", - minusplus: "\u2213", - mnplus: "\u2213", - mp: "\u2213", - setminus: "\u2216", - smallsetminus: "\u2216", - Backslash: "\u2216", - setmn: "\u2216", - ssetmn: "\u2216", - lowbar: "_", - verbar: "|", - vert: "|", - VerticalLine: "|", - colon: ":", - Colon: "\u2237", - Proportion: "\u2237", - ratio: "\u2236", - equals: "=", - ne: "\u2260", - nequiv: "\u2262", - equiv: "\u2261", - Congruent: "\u2261", - sim: "\u223C", - thicksim: "\u223C", - thksim: "\u223C", - sime: "\u2243", - simeq: "\u2243", - TildeEqual: "\u2243", - asymp: "\u2248", - approx: "\u2248", - thickapprox: "\u2248", - thkap: "\u2248", - TildeTilde: "\u2248", - ncong: "\u2247", - cong: "\u2245", - TildeFullEqual: "\u2245", - asympeq: "\u224D", - CupCap: "\u224D", - bump: "\u224E", - Bumpeq: "\u224E", - HumpDownHump: "\u224E", - bumpe: "\u224F", - bumpeq: "\u224F", - HumpEqual: "\u224F", - le: "\u2264", - LessEqual: "\u2264", - ge: "\u2265", - GreaterEqual: "\u2265", - lesseqgtr: "\u22DA", - lesseqqgtr: "\u2A8B", - greater: ">", - less: "<" -}; -var MATH_ADVANCED = { - alefsym: "\u2135", - aleph: "\u2135", - beth: "\u2136", - gimel: "\u2137", - daleth: "\u2138", - forall: "\u2200", - ForAll: "\u2200", - part: "\u2202", - PartialD: "\u2202", - exist: "\u2203", - Exists: "\u2203", - nexist: "\u2204", - nexists: "\u2204", - empty: "\u2205", - emptyset: "\u2205", - emptyv: "\u2205", - varnothing: "\u2205", - nabla: "\u2207", - Del: "\u2207", - isin: "\u2208", - isinv: "\u2208", - in: "\u2208", - Element: "\u2208", - notin: "\u2209", - notinva: "\u2209", - ni: "\u220B", - niv: "\u220B", - SuchThat: "\u220B", - ReverseElement: "\u220B", - notni: "\u220C", - notniva: "\u220C", - prod: "\u220F", - Product: "\u220F", - coprod: "\u2210", - Coproduct: "\u2210", - sum: "\u2211", - Sum: "\u2211", - minus: "\u2212", - mp: "\u2213", - plusdo: "\u2214", - dotplus: "\u2214", - setminus: "\u2216", - lowast: "\u2217", - radic: "\u221A", - Sqrt: "\u221A", - prop: "\u221D", - propto: "\u221D", - Proportional: "\u221D", - varpropto: "\u221D", - infin: "\u221E", - infintie: "\u29DD", - ang: "\u2220", - angle: "\u2220", - angmsd: "\u2221", - measuredangle: "\u2221", - angsph: "\u2222", - mid: "\u2223", - VerticalBar: "\u2223", - nmid: "\u2224", - nsmid: "\u2224", - npar: "\u2226", - parallel: "\u2225", - spar: "\u2225", - nparallel: "\u2226", - nspar: "\u2226", - and: "\u2227", - wedge: "\u2227", - or: "\u2228", - vee: "\u2228", - cap: "\u2229", - cup: "\u222A", - int: "\u222B", - Integral: "\u222B", - conint: "\u222E", - ContourIntegral: "\u222E", - Conint: "\u222F", - DoubleContourIntegral: "\u222F", - Cconint: "\u2230", - there4: "\u2234", - therefore: "\u2234", - Therefore: "\u2234", - becaus: "\u2235", - because: "\u2235", - Because: "\u2235", - ratio: "\u2236", - Proportion: "\u2237", - minusd: "\u2238", - dotminus: "\u2238", - mDDot: "\u223A", - homtht: "\u223B", - sim: "\u223C", - bsimg: "\u223D", - backsim: "\u223D", - ac: "\u223E", - mstpos: "\u223E", - acd: "\u223F", - VerticalTilde: "\u2240", - wr: "\u2240", - wreath: "\u2240", - nsime: "\u2244", - nsimeq: "\u2244", - ncong: "\u2247", - simne: "\u2246", - ncongdot: "\u2A6D\u0338", - ngsim: "\u2275", - nsim: "\u2241", - napprox: "\u2249", - nap: "\u2249", - ngeq: "\u2271", - nge: "\u2271", - nleq: "\u2270", - nle: "\u2270", - ngtr: "\u226F", - ngt: "\u226F", - nless: "\u226E", - nlt: "\u226E", - nprec: "\u2280", - npr: "\u2280", - nsucc: "\u2281", - nsc: "\u2281" -}; -var ARROWS = { - larr: "\u2190", - leftarrow: "\u2190", - LeftArrow: "\u2190", - uarr: "\u2191", - uparrow: "\u2191", - UpArrow: "\u2191", - rarr: "\u2192", - rightarrow: "\u2192", - RightArrow: "\u2192", - darr: "\u2193", - downarrow: "\u2193", - DownArrow: "\u2193", - harr: "\u2194", - leftrightarrow: "\u2194", - LeftRightArrow: "\u2194", - varr: "\u2195", - updownarrow: "\u2195", - UpDownArrow: "\u2195", - nwarr: "\u2196", - nwarrow: "\u2196", - UpperLeftArrow: "\u2196", - nearr: "\u2197", - nearrow: "\u2197", - UpperRightArrow: "\u2197", - searr: "\u2198", - searrow: "\u2198", - LowerRightArrow: "\u2198", - swarr: "\u2199", - swarrow: "\u2199", - LowerLeftArrow: "\u2199", - lArr: "\u21D0", - Leftarrow: "\u21D0", - uArr: "\u21D1", - Uparrow: "\u21D1", - rArr: "\u21D2", - Rightarrow: "\u21D2", - dArr: "\u21D3", - Downarrow: "\u21D3", - hArr: "\u21D4", - Leftrightarrow: "\u21D4", - iff: "\u21D4", - vArr: "\u21D5", - Updownarrow: "\u21D5", - lAarr: "\u21DA", - Lleftarrow: "\u21DA", - rAarr: "\u21DB", - Rrightarrow: "\u21DB", - lrarr: "\u21C6", - leftrightarrows: "\u21C6", - rlarr: "\u21C4", - rightleftarrows: "\u21C4", - lrhar: "\u21CB", - leftrightharpoons: "\u21CB", - ReverseEquilibrium: "\u21CB", - rlhar: "\u21CC", - rightleftharpoons: "\u21CC", - Equilibrium: "\u21CC", - udarr: "\u21C5", - UpArrowDownArrow: "\u21C5", - duarr: "\u21F5", - DownArrowUpArrow: "\u21F5", - llarr: "\u21C7", - leftleftarrows: "\u21C7", - rrarr: "\u21C9", - rightrightarrows: "\u21C9", - ddarr: "\u21CA", - downdownarrows: "\u21CA", - har: "\u21BD", - lhard: "\u21BD", - leftharpoondown: "\u21BD", - lharu: "\u21BC", - leftharpoonup: "\u21BC", - rhard: "\u21C1", - rightharpoondown: "\u21C1", - rharu: "\u21C0", - rightharpoonup: "\u21C0", - lsh: "\u21B0", - Lsh: "\u21B0", - rsh: "\u21B1", - Rsh: "\u21B1", - ldsh: "\u21B2", - rdsh: "\u21B3", - hookleftarrow: "\u21A9", - hookrightarrow: "\u21AA", - mapstoleft: "\u21A4", - mapstoup: "\u21A5", - map: "\u21A6", - mapsto: "\u21A6", - mapstodown: "\u21A7", - crarr: "\u21B5", - nleftarrow: "\u219A", - nleftrightarrow: "\u21AE", - nrightarrow: "\u219B", - nrarr: "\u219B", - larrtl: "\u21A2", - rarrtl: "\u21A3", - leftarrowtail: "\u21A2", - rightarrowtail: "\u21A3", - twoheadleftarrow: "\u219E", - twoheadrightarrow: "\u21A0", - Larr: "\u219E", - Rarr: "\u21A0", - larrhk: "\u21A9", - rarrhk: "\u21AA", - larrlp: "\u21AB", - looparrowleft: "\u21AB", - rarrlp: "\u21AC", - looparrowright: "\u21AC", - harrw: "\u21AD", - leftrightsquigarrow: "\u21AD", - nrarrw: "\u219D\u0338", - rarrw: "\u219D", - rightsquigarrow: "\u219D", - larrbfs: "\u291F", - rarrbfs: "\u2920", - nvHarr: "\u2904", - nvlArr: "\u2902", - nvrArr: "\u2903", - larrfs: "\u291D", - rarrfs: "\u291E", - Map: "\u2905", - larrsim: "\u2973", - rarrsim: "\u2974", - harrcir: "\u2948", - Uarrocir: "\u2949", - lurdshar: "\u294A", - ldrdhar: "\u2967", - ldrushar: "\u294B", - rdldhar: "\u2969", - lrhard: "\u296D", - uharr: "\u21BE", - uharl: "\u21BF", - dharr: "\u21C2", - dharl: "\u21C3", - Uarr: "\u219F", - Darr: "\u21A1", - zigrarr: "\u21DD", - nwArr: "\u21D6", - neArr: "\u21D7", - seArr: "\u21D8", - swArr: "\u21D9", - nharr: "\u21AE", - nhArr: "\u21CE", - nlarr: "\u219A", - nlArr: "\u21CD", - nrArr: "\u21CF", - larrb: "\u21E4", - LeftArrowBar: "\u21E4", - rarrb: "\u21E5", - RightArrowBar: "\u21E5" -}; -var SHAPES = { - square: "\u25A1", - Square: "\u25A1", - squ: "\u25A1", - squf: "\u25AA", - squarf: "\u25AA", - blacksquar: "\u25AA", - blacksquare: "\u25AA", - FilledVerySmallSquare: "\u25AA", - blk34: "\u2593", - blk12: "\u2592", - blk14: "\u2591", - block: "\u2588", - srect: "\u25AD", - rect: "\u25AD", - sdot: "\u22C5", - sdotb: "\u22A1", - dotsquare: "\u22A1", - triangle: "\u25B5", - tri: "\u25B5", - trine: "\u25B5", - utri: "\u25B5", - triangledown: "\u25BF", - dtri: "\u25BF", - tridown: "\u25BF", - triangleleft: "\u25C3", - ltri: "\u25C3", - triangleright: "\u25B9", - rtri: "\u25B9", - blacktriangle: "\u25B4", - utrif: "\u25B4", - blacktriangledown: "\u25BE", - dtrif: "\u25BE", - blacktriangleleft: "\u25C2", - ltrif: "\u25C2", - blacktriangleright: "\u25B8", - rtrif: "\u25B8", - loz: "\u25CA", - lozenge: "\u25CA", - blacklozenge: "\u29EB", - lozf: "\u29EB", - bigcirc: "\u25EF", - xcirc: "\u25EF", - circ: "\u02C6", - Circle: "\u25CB", - cir: "\u25CB", - o: "\u25CB", - bullet: "\u2022", - bull: "\u2022", - hellip: "\u2026", - mldr: "\u2026", - nldr: "\u2025", - boxh: "\u2500", - HorizontalLine: "\u2500", - boxv: "\u2502", - boxdr: "\u250C", - boxdl: "\u2510", - boxur: "\u2514", - boxul: "\u2518", - boxvr: "\u251C", - boxvl: "\u2524", - boxhd: "\u252C", - boxhu: "\u2534", - boxvh: "\u253C", - boxH: "\u2550", - boxV: "\u2551", - boxdR: "\u2552", - boxDr: "\u2553", - boxDR: "\u2554", - boxDl: "\u2555", - boxdL: "\u2556", - boxDL: "\u2557", - boxuR: "\u2558", - boxUr: "\u2559", - boxUR: "\u255A", - boxUl: "\u255C", - boxuL: "\u255B", - boxUL: "\u255D", - boxvR: "\u255E", - boxVr: "\u255F", - boxVR: "\u2560", - boxVl: "\u2562", - boxvL: "\u2561", - boxVL: "\u2563", - boxHd: "\u2564", - boxhD: "\u2565", - boxHD: "\u2566", - boxHu: "\u2567", - boxhU: "\u2568", - boxHU: "\u2569", - boxvH: "\u256A", - boxVh: "\u256B", - boxVH: "\u256C" -}; -var PUNCTUATION = { - excl: "!", - iexcl: "\xA1", - brvbar: "\xA6", - sect: "\xA7", - uml: "\xA8", - copy: "\xA9", - ordf: "\xAA", - laquo: "\xAB", - not: "\xAC", - shy: "\xAD", - reg: "\xAE", - macr: "\xAF", - deg: "\xB0", - plusmn: "\xB1", - sup2: "\xB2", - sup3: "\xB3", - acute: "\xB4", - micro: "\xB5", - para: "\xB6", - middot: "\xB7", - cedil: "\xB8", - sup1: "\xB9", - ordm: "\xBA", - raquo: "\xBB", - frac14: "\xBC", - frac12: "\xBD", - frac34: "\xBE", - iquest: "\xBF", - nbsp: "\xA0", - comma: ",", - period: ".", - colon: ":", - semi: ";", - vert: "|", - Verbar: "\u2016", - verbar: "|", - dblac: "\u02DD", - circ: "\u02C6", - caron: "\u02C7", - breve: "\u02D8", - dot: "\u02D9", - ring: "\u02DA", - ogon: "\u02DB", - tilde: "\u02DC", - DiacriticalGrave: "`", - DiacriticalAcute: "\xB4", - DiacriticalTilde: "\u02DC", - DiacriticalDot: "\u02D9", - DiacriticalDoubleAcute: "\u02DD", - grave: "`" -}; var CURRENCY = { cent: "\xA2", pound: "\xA3", @@ -76901,106 +76138,6 @@ var CURRENCY = { yuan: "\xA5", cedil: "\xB8" }; -var FRACTIONS = { - frac12: "\xBD", - half: "\xBD", - frac13: "\u2153", - frac14: "\xBC", - frac15: "\u2155", - frac16: "\u2159", - frac18: "\u215B", - frac23: "\u2154", - frac25: "\u2156", - frac34: "\xBE", - frac35: "\u2157", - frac38: "\u215C", - frac45: "\u2158", - frac56: "\u215A", - frac58: "\u215D", - frac78: "\u215E", - frasl: "\u2044" -}; -var MISC_SYMBOLS = { - trade: "\u2122", - TRADE: "\u2122", - telrec: "\u2315", - target: "\u2316", - ulcorn: "\u231C", - ulcorner: "\u231C", - urcorn: "\u231D", - urcorner: "\u231D", - dlcorn: "\u231E", - llcorner: "\u231E", - drcorn: "\u231F", - lrcorner: "\u231F", - intercal: "\u22BA", - intcal: "\u22BA", - oplus: "\u2295", - CirclePlus: "\u2295", - ominus: "\u2296", - CircleMinus: "\u2296", - otimes: "\u2297", - CircleTimes: "\u2297", - osol: "\u2298", - odot: "\u2299", - CircleDot: "\u2299", - oast: "\u229B", - circledast: "\u229B", - odash: "\u229D", - circleddash: "\u229D", - ocirc: "\u229A", - circledcirc: "\u229A", - boxplus: "\u229E", - plusb: "\u229E", - boxminus: "\u229F", - minusb: "\u229F", - boxtimes: "\u22A0", - timesb: "\u22A0", - boxdot: "\u22A1", - sdotb: "\u22A1", - veebar: "\u22BB", - vee: "\u2228", - barvee: "\u22BD", - and: "\u2227", - wedge: "\u2227", - Cap: "\u22D2", - Cup: "\u22D3", - Fork: "\u22D4", - pitchfork: "\u22D4", - epar: "\u22D5", - ltlarr: "\u2976", - nvap: "\u224D\u20D2", - nvsim: "\u223C\u20D2", - nvge: "\u2265\u20D2", - nvle: "\u2264\u20D2", - nvlt: "<\u20D2", - nvgt: ">\u20D2", - nvltrie: "\u22B4\u20D2", - nvrtrie: "\u22B5\u20D2", - Vdash: "\u22A9", - dashv: "\u22A3", - vDash: "\u22A8", - Vvdash: "\u22AA", - nvdash: "\u22AC", - nvDash: "\u22AD", - nVdash: "\u22AE", - nVDash: "\u22AF" -}; -var ALL_ENTITIES = { - ...BASIC_LATIN, - ...LATIN_ACCENTS, - ...LATIN_EXTENDED, - ...GREEK, - ...CYRILLIC, - ...MATH, - ...MATH_ADVANCED, - ...ARROWS, - ...SHAPES, - ...PUNCTUATION, - ...CURRENCY, - ...FRACTIONS, - ...MISC_SYMBOLS -}; var XML = { amp: "&", apos: "'", @@ -77644,7 +76781,7 @@ var XmlNode = class { } }; -// node_modules/xml-naming/src/index.js +// node_modules/fast-xml-parser/node_modules/xml-naming/src/index.js var nameStartChar10 = ":A-Za-z_\xC0-\xD6\xD8-\xF6\xF8-\u02FF\u0370-\u037D\u037F-\u0486\u0488-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD"; var nameChar10 = nameStartChar10 + "\\-\\.\\d\xB7\u0300-\u036F\u203F-\u2040"; var nameStartChar11 = ":A-Za-z_\xC0-\u02FF\u0370-\u037D\u037F-\u0486\u0488-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\u{10000}-\u{EFFFF}"; @@ -77663,8 +76800,14 @@ var buildRegexes = (startChar, char, flags = "") => { }; var regexes10 = buildRegexes(nameStartChar10, nameChar10); var regexes11 = buildRegexes(nameStartChar11, nameChar11, "u"); -var getRegexes = (xmlVersion = "1.0") => xmlVersion === "1.1" ? regexes11 : regexes10; -var qName = (str, { xmlVersion = "1.0" } = {}) => getRegexes(xmlVersion).qName.test(str); +var nameStartCharAscii = ":A-Za-z_"; +var nameCharAscii = nameStartCharAscii + "\\-\\.\\d"; +var regexesAscii = buildRegexes(nameStartCharAscii, nameCharAscii); +var getRegexes = (xmlVersion = "1.0", asciiOnly = false) => { + if (asciiOnly) return regexesAscii; + return xmlVersion === "1.1" ? regexes11 : regexes10; +}; +var qName = (str, { xmlVersion = "1.0", asciiOnly = false } = {}) => getRegexes(xmlVersion, asciiOnly).qName.test(str); // node_modules/fast-xml-parser/src/xmlparser/DocTypeReader.js var DocTypeReader = class { @@ -79493,27 +78636,6 @@ var SQL_PATTERNS = [ ]; var sql_default = SQL_PATTERNS; -// node_modules/is-unsafe/src/contexts/sql-strict.js -var SQL_STRICT_EXTRA = [ - { - id: "sql-line-comment", - description: "SQL line comment: -- followed by whitespace or end of string", - pattern: /--(?:\s|$)/ - }, - { - id: "sql-stacked-query", - description: "Stacked queries: semicolon immediately followed by a SQL keyword", - pattern: /;\s{0,10}(?:SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC)\b/i - }, - { - id: "sql-hex-encoding", - description: "Hex-encoded string injection: 0x41414141 style (MySQL)", - pattern: /\b0x[0-9a-f]{4,}/i - } -]; -var SQL_STRICT_PATTERNS = [...sql_default, ...SQL_STRICT_EXTRA]; -var sql_strict_default = SQL_STRICT_PATTERNS; - // node_modules/is-unsafe/src/contexts/shell.js var SHELL_PATTERNS = [ { @@ -79825,8 +78947,38 @@ var LOG_PATTERNS = [ ]; var log_default = LOG_PATTERNS; -// node_modules/is-unsafe/src/registry.js -var CONTEXT_REGISTRY = { +// node_modules/is-unsafe/src/contexts/sql-strict.js +var SQL_STRICT_EXTRA = [ + { + id: "sql-line-comment", + description: "SQL line comment: -- followed by whitespace or end of string", + pattern: /--(?:\s|$)/ + }, + { + id: "sql-stacked-query", + description: "Stacked queries: semicolon immediately followed by a SQL keyword", + pattern: /;\s{0,10}(?:SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC)\b/i + }, + { + id: "sql-hex-encoding", + description: "Hex-encoded string injection: 0x41414141 style (MySQL)", + pattern: /\b0x[0-9a-f]{4,}/i + } +]; +var SQL_STRICT_PATTERNS = [...sql_default, ...SQL_STRICT_EXTRA]; +var sql_strict_default = SQL_STRICT_PATTERNS; + +// node_modules/is-unsafe/src/index.js +html_default.label = "HTML"; +xml_default.label = "XML"; +svg_default.label = "SVG"; +sql_default.label = "SQL"; +sql_strict_default.label = "SQL-STRICT"; +shell_default.label = "SHELL"; +redos_default.label = "REDOS"; +nosql_default.label = "NOSQL"; +log_default.label = "LOG"; +var VALID_CONTEXTS = Object.freeze({ HTML: html_default, XML: xml_default, SVG: svg_default, @@ -79836,13 +78988,7 @@ var CONTEXT_REGISTRY = { REDOS: redos_default, NOSQL: nosql_default, LOG: log_default -}; -var registry_default = CONTEXT_REGISTRY; -var VALID_CONTEXTS = Object.freeze( - Object.fromEntries(Object.keys(CONTEXT_REGISTRY).map((k) => [k, k])) -); - -// node_modules/is-unsafe/src/index.js +}); function assertString(value) { if (typeof value !== "string") { throw new TypeError( @@ -79852,36 +78998,35 @@ function assertString(value) { } function assertContext(context3) { if (context3 instanceof RegExp) return; - if (typeof context3 === "string") { - if (!registry_default[context3]) { - throw new TypeError( - `is-unsafe: unknown context "${context3}". Valid contexts: ${Object.keys(VALID_CONTEXTS).join(", ")}` - ); - } - return; - } if (Array.isArray(context3)) { if (context3.length === 0) { - throw new TypeError("is-unsafe: context array must not be empty"); + throw new TypeError("is-unsafe: context must not be an empty array"); } - for (const c of context3) { - if (typeof c !== "string" || !registry_default[c]) { - throw new TypeError( - `is-unsafe: unknown context "${c}" in array. Valid contexts: ${Object.keys(VALID_CONTEXTS).join(", ")}` - ); + if (Array.isArray(context3[0])) { + for (const list of context3) { + if (!Array.isArray(list) || list.length === 0) { + throw new TypeError( + "is-unsafe: each context in the array must be a non-empty pattern array (PatternList)" + ); + } } } return; } throw new TypeError( - `is-unsafe: second argument must be a context string, array of context strings, or RegExp. Got: ${typeof context3}` + `is-unsafe: second argument must be a PatternList (e.g. HTML), an array of PatternLists (e.g. [HTML, XML]), or a RegExp. Got: ${typeof context3}` ); } -function matchContext(value, contextName) { - const patterns = registry_default[contextName]; - for (const rule of patterns) { +function normalise(context3) { + if (context3 instanceof RegExp) return { lists: null, regex: context3 }; + if (Array.isArray(context3[0])) return { lists: context3, regex: null }; + return { lists: [context3], regex: null }; +} +function matchList(value, list) { + const label = list.label ?? "CUSTOM"; + for (const rule of list) { if (rule.pattern.test(value)) { - return { context: contextName, id: rule.id, description: rule.description, pattern: rule.pattern }; + return { context: label, id: rule.id, description: rule.description, pattern: rule.pattern }; } } return null; @@ -79889,14 +79034,10 @@ function matchContext(value, contextName) { function isUnsafe(value, context3) { assertString(value); assertContext(context3); - if (context3 instanceof RegExp) { - return context3.test(value); - } - if (typeof context3 === "string") { - return matchContext(value, context3) !== null; - } - for (const c of context3) { - if (matchContext(value, c) !== null) return true; + const { lists, regex } = normalise(context3); + if (regex) return regex.test(value); + for (const list of lists) { + if (matchList(value, list) !== null) return true; } return false; } @@ -79945,6 +79086,7 @@ var OrderedObjParser = class { this.ignoreAttributesFn = getIgnoreAttributesFn(this.options.ignoreAttributes); this.entityExpansionCount = 0; this.currentExpandedLength = 0; + this.doctypefound = false; let namedEntities = { ...XML }; if (this.options.entityDecoder) { this.entityDecoder = this.options.entityDecoder; @@ -79962,7 +79104,7 @@ var OrderedObjParser = class { // onExternalEntity: (name, value) => isUnsafe(value) ? 'block' : 'allow', onInputEntity: (name, value) => ( //TODO: VALID_CONTEXTS.HTML should be set only if this.options.htmlEntities - isUnsafe(value, [VALID_CONTEXTS.HTML, VALID_CONTEXTS.XML]) ? ENTITY_ACTION.BLOCK : ENTITY_ACTION.ALLOW + isUnsafe(value, [html_default, xml_default]) ? ENTITY_ACTION.BLOCK : ENTITY_ACTION.ALLOW ) //postCheck: resolved => resolved }); @@ -80096,6 +79238,7 @@ var parseXml = function(xmlData) { this.entityDecoder.reset(); this.entityExpansionCount = 0; this.currentExpandedLength = 0; + this.doctypefound = false; const options = this.options; const docTypeReader = new DocTypeReader(options.processEntities); const xmlLen = xmlData.length; @@ -80158,6 +79301,8 @@ var parseXml = function(xmlData) { } i = endIndex; } else if (c1 === 33 && xmlData.charCodeAt(i + 2) === 68) { + if (this.doctypefound) throw new Error("Multiple DOCTYPE declarations found."); + this.doctypefound = true; const result = docTypeReader.readDocType(xmlData, i); this.entityDecoder.addInputEntities(result.entities); i = result.i; @@ -80670,6 +79815,28 @@ function escapeAttribute(val) { return String(val).replace(/"/g, """).replace(/'/g, "'"); } +// node_modules/xml-naming/src/index.js +var nameStartChar102 = ":A-Za-z_\xC0-\xD6\xD8-\xF6\xF8-\u02FF\u0370-\u037D\u037F-\u0486\u0488-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD"; +var nameChar102 = nameStartChar102 + "\\-\\.\\d\xB7\u0300-\u036F\u203F-\u2040"; +var nameStartChar112 = ":A-Za-z_\xC0-\u02FF\u0370-\u037D\u037F-\u0486\u0488-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\u{10000}-\u{EFFFF}"; +var nameChar112 = nameStartChar112 + "\\-\\.\\d\xB7\u0300-\u036F\u0487\u203F-\u2040"; +var buildRegexes2 = (startChar, char, flags = "") => { + const ncStart = startChar.replace(":", ""); + const ncChar = char.replace(":", ""); + const ncNamePat = `[${ncStart}][${ncChar}]*`; + return { + name: new RegExp(`^[${startChar}][${char}]*$`, flags), + ncName: new RegExp(`^${ncNamePat}$`, flags), + qName: new RegExp(`^${ncNamePat}(?::${ncNamePat})?$`, flags), + nmToken: new RegExp(`^[${char}]+$`, flags), + nmTokens: new RegExp(`^[${char}]+(?:\\s+[${char}]+)*$`, flags) + }; +}; +var regexes102 = buildRegexes2(nameStartChar102, nameChar102); +var regexes112 = buildRegexes2(nameStartChar112, nameChar112, "u"); +var getRegexes2 = (xmlVersion = "1.0") => xmlVersion === "1.1" ? regexes112 : regexes102; +var qName2 = (str, { xmlVersion = "1.0" } = {}) => getRegexes2(xmlVersion).qName.test(str); + // node_modules/fast-xml-builder/src/orderedJs2Xml.js var EOL7 = "\n"; function detectXmlVersionFromArray(jArray, options) { @@ -80687,7 +79854,7 @@ function detectXmlVersionFromArray(jArray, options) { } function resolveTagName(name, isAttribute2, options, matcher, xmlVersion) { if (!options.sanitizeName) return name; - if (qName(name, { xmlVersion })) return name; + if (qName2(name, { xmlVersion })) return name; return options.sanitizeName(name, { isAttribute: isAttribute2, matcher: matcher.readOnly() }); } function toXml(jArray, options) { @@ -81032,7 +80199,7 @@ function detectXmlVersionFromObj(jObj, options) { } function resolveTagName2(name, isAttribute2, options, matcher, xmlVersion) { if (!options.sanitizeName) return name; - if (qName(name, { xmlVersion })) return name; + if (qName2(name, { xmlVersion })) return name; return options.sanitizeName(name, { isAttribute: isAttribute2, matcher: matcher.readOnly() }); } Builder.prototype.build = function(jObj) { From f10f816e0d5fca0095a30418e943fe6563d1148f Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 14:26:18 +0000 Subject: [PATCH 3/4] fix: apply audit fixes --- dist/update-known-checksums/index.cjs | 94 +++++++++++++++++++++++++-- 1 file changed, 88 insertions(+), 6 deletions(-) diff --git a/dist/update-known-checksums/index.cjs b/dist/update-known-checksums/index.cjs index 3c7ce64..0f7d473 100644 --- a/dist/update-known-checksums/index.cjs +++ b/dist/update-known-checksums/index.cjs @@ -1928,7 +1928,11 @@ var require_request = __commonJS({ } else if (typeof val[i] === "object") { throw new InvalidArgumentError(`invalid ${key} header`); } else { - arr.push(`${val[i]}`); + const str = `${val[i]}`; + if (!isValidHeaderValue(str)) { + throw new InvalidArgumentError(`invalid ${key} header`); + } + arr.push(str); } } val = arr; @@ -1940,6 +1944,9 @@ var require_request = __commonJS({ val = ""; } else { val = `${val}`; + if (!isValidHeaderValue(val)) { + throw new InvalidArgumentError(`invalid ${key} header`); + } } if (headerName === "host") { if (request.host !== null) { @@ -5670,6 +5677,7 @@ var require_client_h1 = __commonJS({ RequestContentLengthMismatchError, ResponseContentLengthMismatchError, RequestAbortedError, + InvalidArgumentError, HeadersTimeoutError, HeadersOverflowError, SocketError, @@ -6396,8 +6404,16 @@ var require_client_h1 = __commonJS({ } body = bodyStream.stream; contentLength = bodyStream.length; - } else if (util4.isBlobLike(body) && request.contentType == null && body.type) { - headers.push("content-type", body.type); + } else if (util4.isBlobLike(body) && request.contentType == null) { + const contentType = body.type; + if (contentType) { + const contentTypeValue = `${contentType}`; + if (!util4.isValidHeaderValue(contentTypeValue)) { + util4.errorRequest(client, request, new InvalidArgumentError("invalid content-type header")); + return false; + } + headers.push("content-type", contentTypeValue); + } } if (body && typeof body.read === "function") { body.read(0); @@ -8949,6 +8965,24 @@ var require_retry_handler = __commonJS({ const current = Date.now(); return new Date(retryAfter).getTime() - current; } + function validatePartialResponseContentLength(headers, range, statusCode, retryCount) { + const contentLength = headers["content-length"]; + if (contentLength == null) { + return null; + } + if (!Number.isFinite(range.start) || !Number.isFinite(range.end)) { + return null; + } + const length = Number(contentLength); + const expectedLength = range.end - range.start + 1; + if (!Number.isFinite(length) || length !== expectedLength) { + return new RequestRetryError("Content-Length mismatch", statusCode, { + headers, + data: { count: retryCount } + }); + } + return null; + } var RetryHandler = class _RetryHandler { constructor(opts, handlers) { const { retryOptions, ...dispatchOpts } = opts; @@ -9121,6 +9155,11 @@ var require_retry_handler = __commonJS({ ); return false; } + const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount); + if (contentLengthError != null) { + this.abort(contentLengthError); + return false; + } const { start, size, end = size - 1 } = contentRange; assert(this.start === start, "content-range mismatch"); assert(this.end == null || this.end === end, "content-range mismatch"); @@ -9138,6 +9177,11 @@ var require_retry_handler = __commonJS({ statusMessage ); } + const contentLengthError = validatePartialResponseContentLength(headers, range, statusCode, this.retryCount); + if (contentLengthError != null) { + this.abort(contentLengthError); + return false; + } const { start, size, end = size - 1 } = range; assert( start != null && Number.isFinite(start), @@ -15983,14 +16027,48 @@ var require_util6 = __commonJS({ for (let i = 0; i < path.length; ++i) { const code = path.charCodeAt(i); if (code < 32 || // exclude CTLs (0-31) - code === 127 || // DEL + code > 126 || // exclude DEL and non-ascii code === 59) { throw new Error("Invalid cookie path"); } } } + function isLetterOrDigit(code) { + return code >= 48 && code <= 57 || // 0-9 + code >= 65 && code <= 90 || // A-Z + code >= 97 && code <= 122; + } function validateCookieDomain(domain) { - if (domain.startsWith("-") || domain.endsWith(".") || domain.endsWith("-")) { + if (domain === " ") { + return; + } + if (domain.length > 255) { + throw new Error("Invalid cookie domain"); + } + let labelLength = 0; + for (let i = 0; i < domain.length; ++i) { + const code = domain.charCodeAt(i); + if (code === 46) { + if (labelLength === 0) { + throw new Error("Invalid cookie domain"); + } + if (domain.charCodeAt(i - 1) === 45) { + throw new Error("Invalid cookie domain"); + } + labelLength = 0; + continue; + } + if (labelLength === 0 && !isLetterOrDigit(code)) { + throw new Error("Invalid cookie domain"); + } + if (!isLetterOrDigit(code) && code !== 45) { + throw new Error("Invalid cookie domain"); + } + if (++labelLength > 63) { + throw new Error("Invalid cookie domain"); + } + } + if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 45) { throw new Error("Invalid cookie domain"); } } @@ -16073,7 +16151,11 @@ var require_util6 = __commonJS({ throw new Error("Invalid unparsed"); } const [key, ...value] = part.split("="); - out.push(`${key.trim()}=${value.join("=")}`); + const trimmedKey = key.trim(); + const joinedValue = value.join("="); + validateCookieName(trimmedKey); + validateCookieValue(joinedValue); + out.push(`${trimmedKey}=${joinedValue}`); } return out.join("; "); } From 8a728f054f7e897520ebc3b5d1a384d4732b5935 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 14:26:21 +0000 Subject: [PATCH 4/4] fix: apply audit fixes --- package-lock.json | 65 +++++++++++++++++++++++++++++------------------ 1 file changed, 40 insertions(+), 25 deletions(-) diff --git a/package-lock.json b/package-lock.json index 469a749..2619fff 100644 --- a/package-lock.json +++ b/package-lock.json @@ -148,9 +148,9 @@ } }, "node_modules/@actions/http-client/node_modules/undici": { - "version": "6.27.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz", - "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==", + "version": "6.28.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz", + "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==", "license": "MIT", "engines": { "node": ">=18.17" @@ -1582,9 +1582,9 @@ } }, "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": { - "version": "3.15.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", - "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", + "version": "3.15.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", + "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", "dev": true, "license": "MIT", "dependencies": { @@ -2014,9 +2014,9 @@ } }, "node_modules/@nodable/entities": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-2.2.0.tgz", - "integrity": "sha512-9uGyhaQavEUMC8AIddIjau4NsnsXhou+j5sBAGojCM1oxmQpVKTWR/9JxABD6UAv12vpIms55fPZKFQEhG6uBg==", + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-3.0.0.tgz", + "integrity": "sha512-8L9xFeTYKhm49xfIypoe2W5wV1m/3Z58kT+7kR9A8OyFxcPduI4VmxaUMQyKYrRjUoLLSXv6EKKID5Tvj9cUVw==", "funding": [ { "type": "github", @@ -2864,9 +2864,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", @@ -3530,9 +3530,9 @@ } }, "node_modules/fast-xml-parser": { - "version": "5.9.3", - "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.9.3.tgz", - "integrity": "sha512-brCNCeScma/kqa54J4PIDriSSSLssRkuYaUCpvHJulGc3HGI/xxKUCTDcYkAdqJsyb//ydpbxecjC3hB9+tb/g==", + "version": "5.10.1", + "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.10.1.tgz", + "integrity": "sha512-IEMIf7298kXuZSRFoGfMYrl7is8LpavODgbNz1cwIudv7KwVFnuU+UsMporfq6PD6aXSlawZlARiA3UywCTfMw==", "funding": [ { "type": "github", @@ -3541,17 +3541,32 @@ ], "license": "MIT", "dependencies": { - "@nodable/entities": "^2.2.0", + "@nodable/entities": "^3.0.0", "fast-xml-builder": "^1.2.0", - "is-unsafe": "^1.0.1", - "path-expression-matcher": "^1.5.0", + "is-unsafe": "^2.0.0", + "path-expression-matcher": "^1.6.2", "strnum": "^2.4.1", - "xml-naming": "^0.1.0" + "xml-naming": "^0.3.0" }, "bin": { "fxparser": "src/cli/cli.js" } }, + "node_modules/fast-xml-parser/node_modules/xml-naming": { + "version": "0.3.0", + "resolved": "https://registry.npmjs.org/xml-naming/-/xml-naming-0.3.0.tgz", + "integrity": "sha512-ghig2TBE/H11aOVgmahA3MhimvkBr6JIYknH/Dhdk10nXwdbIqBJsbfMxpvFPG8bAw77gN29aQWvKpmVoPlvPQ==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/NaturalIntelligence" + } + ], + "license": "MIT", + "engines": { + "node": ">=16.0.0" + } + }, "node_modules/fb-watchman": { "version": "2.0.2", "resolved": "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.2.tgz", @@ -3760,9 +3775,9 @@ } }, "node_modules/glob/node_modules/brace-expansion": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz", - "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -4006,9 +4021,9 @@ } }, "node_modules/is-unsafe": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/is-unsafe/-/is-unsafe-1.0.1.tgz", - "integrity": "sha512-CLK2+VdgERgD96EYm5lUQssZYlRg2tkZnbsxZoacmSiRxiFJ4Nk4SzjCl+Ur+v3kXIY9dTIdb3IH22y1mZ56LA==", + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/is-unsafe/-/is-unsafe-2.0.0.tgz", + "integrity": "sha512-2LdV822R+wmI86unXA93WCFpL6g+av8ynWk0nrHyJqGop5VoocYsSLFgN8jrfalT6iGeLNM4KXuVSsULP53kEA==", "funding": [ { "type": "github",