From a030b460ffa45b6e9fe3ed2debbadf0f29cd3e6e Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 23 Jul 2026 07:30:54 +0000 Subject: [PATCH] fix: apply audit fixes --- dist/index.js | 634 +++++++++++++++++++++++++------------------------- 1 file changed, 317 insertions(+), 317 deletions(-) diff --git a/dist/index.js b/dist/index.js index 89af9c1..381f9bb 100644 --- a/dist/index.js +++ b/dist/index.js @@ -5381,103 +5381,103 @@ module.exports = new Set(internals.tlds.map((tld) => tld.toLowerCase())); /***/ ((__unused_webpack_module, exports) => { "use strict"; - - - -const internals = { - suspectRx: /"(?:_|\\u005[Ff])(?:_|\\u005[Ff])(?:p|\\u0070)(?:r|\\u0072)(?:o|\\u006[Ff])(?:t|\\u0074)(?:o|\\u006[Ff])(?:_|\\u005[Ff])(?:_|\\u005[Ff])"\s*\:/ -}; - - -exports.parse = function (text, reviver, options) { - - // Normalize arguments - - if (!options) { - if (reviver && - typeof reviver === 'object') { - - options = reviver; - reviver = undefined; - } - else { - options = {}; - } - } - - // Parse normally, allowing exceptions - - const obj = JSON.parse(text, reviver); - - // options.protoAction: 'error' (default) / 'remove' / 'ignore' - - if (options.protoAction === 'ignore') { - return obj; - } - - // Ignore null and non-objects - - if (!obj || - typeof obj !== 'object') { - - return obj; - } - - // Check original string for potential exploit - - if (!text.match(internals.suspectRx)) { - return obj; - } - - // Scan result for proto keys - - exports.scan(obj, options); - - return obj; -}; - - -exports.scan = function (obj, options) { - - options = options || {}; - - let next = [obj]; - - while (next.length) { - const nodes = next; - next = []; - - for (const node of nodes) { - if (Object.prototype.hasOwnProperty.call(node, '__proto__')) { // Avoid calling node.hasOwnProperty directly - if (options.protoAction !== 'remove') { - throw new SyntaxError('Object contains forbidden prototype property'); - } - - delete node.__proto__; - } - - for (const key in node) { - const value = node[key]; - if (value && - typeof value === 'object') { - - next.push(node[key]); - } - } - } - } -}; - - -exports.safeParse = function (text, reviver) { - - try { - return exports.parse(text, reviver); - } - catch (ignoreError) { - return null; - } -}; + + + +const internals = { + suspectRx: /"(?:_|\\u005[Ff])(?:_|\\u005[Ff])(?:p|\\u0070)(?:r|\\u0072)(?:o|\\u006[Ff])(?:t|\\u0074)(?:o|\\u006[Ff])(?:_|\\u005[Ff])(?:_|\\u005[Ff])"\s*\:/ +}; + + +exports.parse = function (text, reviver, options) { + + // Normalize arguments + + if (!options) { + if (reviver && + typeof reviver === 'object') { + + options = reviver; + reviver = undefined; + } + else { + options = {}; + } + } + + // Parse normally, allowing exceptions + + const obj = JSON.parse(text, reviver); + + // options.protoAction: 'error' (default) / 'remove' / 'ignore' + + if (options.protoAction === 'ignore') { + return obj; + } + + // Ignore null and non-objects + + if (!obj || + typeof obj !== 'object') { + + return obj; + } + + // Check original string for potential exploit + + if (!text.match(internals.suspectRx)) { + return obj; + } + + // Scan result for proto keys + + exports.scan(obj, options); + + return obj; +}; + + +exports.scan = function (obj, options) { + + options = options || {}; + + let next = [obj]; + + while (next.length) { + const nodes = next; + next = []; + + for (const node of nodes) { + if (Object.prototype.hasOwnProperty.call(node, '__proto__')) { // Avoid calling node.hasOwnProperty directly + if (options.protoAction !== 'remove') { + throw new SyntaxError('Object contains forbidden prototype property'); + } + + delete node.__proto__; + } + + for (const key in node) { + const value = node[key]; + if (value && + typeof value === 'object') { + + next.push(node[key]); + } + } + } + } +}; + + +exports.safeParse = function (text, reviver) { + + try { + return exports.parse(text, reviver); + } + catch (ignoreError) { + return null; + } +}; /***/ }), @@ -13529,221 +13529,221 @@ module.exports = function (timeout) { /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { "use strict"; - - -const Assert = __nccwpck_require__(4195); - - -const internals = {}; - - -module.exports = class Topo { - - constructor() { - - this._items = []; - this.nodes = []; - } - - add(nodes, options) { - - options = options || {}; - - // Validate rules - - const before = [].concat(options.before || []); - const after = [].concat(options.after || []); - const group = options.group || '?'; - const sort = options.sort || 0; // Used for merging only - - Assert(!before.includes(group), `Item cannot come before itself: ${group}`); - Assert(!before.includes('?'), 'Item cannot come before unassociated items'); - Assert(!after.includes(group), `Item cannot come after itself: ${group}`); - Assert(!after.includes('?'), 'Item cannot come after unassociated items'); - - if (!Array.isArray(nodes)) { - nodes = [nodes]; - } - - for (const node of nodes) { - const item = { - seq: this._items.length, - sort, - before, - after, - group, - node - }; - - this._items.push(item); - } - - // Insert event - - const valid = this._sort(); - Assert(valid, 'item', group !== '?' ? `added into group ${group}` : '', 'created a dependencies error'); - - return this.nodes; - } - - merge(others) { - - if (!Array.isArray(others)) { - others = [others]; - } - - for (const other of others) { - if (other) { - for (const item of other._items) { - this._items.push(Object.assign({}, item)); // Shallow cloned - } - } - } - - // Sort items - - this._items.sort(internals.mergeSort); - for (let i = 0; i < this._items.length; ++i) { - this._items[i].seq = i; - } - - const valid = this._sort(); - Assert(valid, 'merge created a dependencies error'); - - return this.nodes; - } - - _sort() { - - // Construct graph - - const graph = {}; - const graphAfters = Object.create(null); // A prototype can bungle lookups w/ false positives - const groups = Object.create(null); - - for (const item of this._items) { - const seq = item.seq; // Unique across all items - const group = item.group; - - // Determine Groups - - groups[group] = groups[group] || []; - groups[group].push(seq); - - // Build intermediary graph using 'before' - - graph[seq] = item.before; - - // Build second intermediary graph with 'after' - - for (const after of item.after) { - graphAfters[after] = graphAfters[after] || []; - graphAfters[after].push(seq); - } - } - - // Expand intermediary graph - - for (const node in graph) { - const expandedGroups = []; - - for (const graphNodeItem in graph[node]) { - const group = graph[node][graphNodeItem]; - groups[group] = groups[group] || []; - expandedGroups.push(...groups[group]); - } - - graph[node] = expandedGroups; - } - - // Merge intermediary graph using graphAfters into final graph - - for (const group in graphAfters) { - if (groups[group]) { - for (const node of groups[group]) { - graph[node].push(...graphAfters[group]); - } - } - } - - // Compile ancestors - - const ancestors = {}; - for (const node in graph) { - const children = graph[node]; - for (const child of children) { - ancestors[child] = ancestors[child] || []; - ancestors[child].push(node); - } - } - - // Topo sort - - const visited = {}; - const sorted = []; - - for (let i = 0; i < this._items.length; ++i) { // Looping through item.seq values out of order - let next = i; - - if (ancestors[i]) { - next = null; - for (let j = 0; j < this._items.length; ++j) { // As above, these are item.seq values - if (visited[j] === true) { - continue; - } - - if (!ancestors[j]) { - ancestors[j] = []; - } - - const shouldSeeCount = ancestors[j].length; - let seenCount = 0; - for (let k = 0; k < shouldSeeCount; ++k) { - if (visited[ancestors[j][k]]) { - ++seenCount; - } - } - - if (seenCount === shouldSeeCount) { - next = j; - break; - } - } - } - - if (next !== null) { - visited[next] = true; - sorted.push(next); - } - } - - if (sorted.length !== this._items.length) { - return false; - } - - const seqIndex = {}; - for (const item of this._items) { - seqIndex[item.seq] = item; - } - - this._items = []; - this.nodes = []; - - for (const value of sorted) { - const sortedItem = seqIndex[value]; - this.nodes.push(sortedItem.node); - this._items.push(sortedItem); - } - - return true; - } -}; - - -internals.mergeSort = (a, b) => { - - return a.sort === b.sort ? 0 : (a.sort < b.sort ? -1 : 1); -}; + + +const Assert = __nccwpck_require__(4195); + + +const internals = {}; + + +module.exports = class Topo { + + constructor() { + + this._items = []; + this.nodes = []; + } + + add(nodes, options) { + + options = options || {}; + + // Validate rules + + const before = [].concat(options.before || []); + const after = [].concat(options.after || []); + const group = options.group || '?'; + const sort = options.sort || 0; // Used for merging only + + Assert(!before.includes(group), `Item cannot come before itself: ${group}`); + Assert(!before.includes('?'), 'Item cannot come before unassociated items'); + Assert(!after.includes(group), `Item cannot come after itself: ${group}`); + Assert(!after.includes('?'), 'Item cannot come after unassociated items'); + + if (!Array.isArray(nodes)) { + nodes = [nodes]; + } + + for (const node of nodes) { + const item = { + seq: this._items.length, + sort, + before, + after, + group, + node + }; + + this._items.push(item); + } + + // Insert event + + const valid = this._sort(); + Assert(valid, 'item', group !== '?' ? `added into group ${group}` : '', 'created a dependencies error'); + + return this.nodes; + } + + merge(others) { + + if (!Array.isArray(others)) { + others = [others]; + } + + for (const other of others) { + if (other) { + for (const item of other._items) { + this._items.push(Object.assign({}, item)); // Shallow cloned + } + } + } + + // Sort items + + this._items.sort(internals.mergeSort); + for (let i = 0; i < this._items.length; ++i) { + this._items[i].seq = i; + } + + const valid = this._sort(); + Assert(valid, 'merge created a dependencies error'); + + return this.nodes; + } + + _sort() { + + // Construct graph + + const graph = {}; + const graphAfters = Object.create(null); // A prototype can bungle lookups w/ false positives + const groups = Object.create(null); + + for (const item of this._items) { + const seq = item.seq; // Unique across all items + const group = item.group; + + // Determine Groups + + groups[group] = groups[group] || []; + groups[group].push(seq); + + // Build intermediary graph using 'before' + + graph[seq] = item.before; + + // Build second intermediary graph with 'after' + + for (const after of item.after) { + graphAfters[after] = graphAfters[after] || []; + graphAfters[after].push(seq); + } + } + + // Expand intermediary graph + + for (const node in graph) { + const expandedGroups = []; + + for (const graphNodeItem in graph[node]) { + const group = graph[node][graphNodeItem]; + groups[group] = groups[group] || []; + expandedGroups.push(...groups[group]); + } + + graph[node] = expandedGroups; + } + + // Merge intermediary graph using graphAfters into final graph + + for (const group in graphAfters) { + if (groups[group]) { + for (const node of groups[group]) { + graph[node].push(...graphAfters[group]); + } + } + } + + // Compile ancestors + + const ancestors = {}; + for (const node in graph) { + const children = graph[node]; + for (const child of children) { + ancestors[child] = ancestors[child] || []; + ancestors[child].push(node); + } + } + + // Topo sort + + const visited = {}; + const sorted = []; + + for (let i = 0; i < this._items.length; ++i) { // Looping through item.seq values out of order + let next = i; + + if (ancestors[i]) { + next = null; + for (let j = 0; j < this._items.length; ++j) { // As above, these are item.seq values + if (visited[j] === true) { + continue; + } + + if (!ancestors[j]) { + ancestors[j] = []; + } + + const shouldSeeCount = ancestors[j].length; + let seenCount = 0; + for (let k = 0; k < shouldSeeCount; ++k) { + if (visited[ancestors[j][k]]) { + ++seenCount; + } + } + + if (seenCount === shouldSeeCount) { + next = j; + break; + } + } + } + + if (next !== null) { + visited[next] = true; + sorted.push(next); + } + } + + if (sorted.length !== this._items.length) { + return false; + } + + const seqIndex = {}; + for (const item of this._items) { + seqIndex[item.seq] = item; + } + + this._items = []; + this.nodes = []; + + for (const value of sorted) { + const sortedItem = seqIndex[value]; + this.nodes.push(sortedItem.node); + this._items.push(sortedItem); + } + + return true; + } +}; + + +internals.mergeSort = (a, b) => { + + return a.sort === b.sort ? 0 : (a.sort < b.sort ? -1 : 1); +}; /***/ }), @@ -64024,10 +64024,10 @@ function waitFileImpl(oldOpts, cb) { }; }); } - /* Stability checking occurs by using an Rx window, - It waits until all of the vals from the resources are >=0, - then it waits for a window which has no changes - (duplicate outputs are filtered by distinctUntilChanged) + /* Stability checking occurs by using an Rx window, + It waits until all of the vals from the resources are >=0, + then it waits for a window which has no changes + (duplicate outputs are filtered by distinctUntilChanged) */ @@ -70466,7 +70466,7 @@ module.exports = axios; /***/ ((module) => { "use strict"; -module.exports = /*#__PURE__*/JSON.parse('{"_from":"@hapi/joi@^15.1.0","_id":"@hapi/joi@15.1.1","_inBundle":false,"_integrity":"sha512-entf8ZMOK8sc+8YfeOlM8pCfg3b5+WZIKBfUaaJT8UsjAAPjartzxIYm3TIbjvA4u+u++KbcXD38k682nVHDAQ==","_location":"/@hapi/joi","_phantomChildren":{},"_requested":{"type":"range","registry":true,"raw":"@hapi/joi@^15.1.0","name":"@hapi/joi","escapedName":"@hapi%2fjoi","scope":"@hapi","rawSpec":"^15.1.0","saveSpec":null,"fetchSpec":"^15.1.0"},"_requiredBy":["/wait-file"],"_resolved":"https://registry.npmjs.org/@hapi/joi/-/joi-15.1.1.tgz","_shasum":"c675b8a71296f02833f8d6d243b34c57b8ce19d7","_spec":"@hapi/joi@^15.1.0","_where":"/home/wyrihaximus/Projects/WyriHaximus/github-action-helm3/node_modules/wait-file","bugs":{"url":"https://github.com/hapijs/joi/issues"},"bundleDependencies":false,"dependencies":{"@hapi/address":"2.x.x","@hapi/bourne":"1.x.x","@hapi/hoek":"8.x.x","@hapi/topo":"3.x.x"},"deprecated":"Switch to \'npm install joi\'","description":"Object schema validation","devDependencies":{"@hapi/code":"6.x.x","@hapi/lab":"20.x.x"},"homepage":"https://github.com/hapijs/joi","keywords":["schema","validation"],"license":"BSD-3-Clause","main":"lib/index.js","name":"@hapi/joi","repository":{"type":"git","url":"git://github.com/hapijs/joi.git"},"scripts":{"test":"lab -t 100 -a @hapi/code -L","test-cov-html":"lab -r html -o coverage.html -a @hapi/code"},"version":"15.1.1"}'); +module.exports = /*#__PURE__*/JSON.parse('{"name":"@hapi/joi","description":"Object schema validation","version":"15.1.1","homepage":"https://github.com/hapijs/joi","repository":"git://github.com/hapijs/joi","main":"lib/index.js","keywords":["schema","validation"],"dependencies":{"@hapi/address":"2.x.x","@hapi/bourne":"1.x.x","@hapi/hoek":"8.x.x","@hapi/topo":"3.x.x"},"devDependencies":{"@hapi/code":"6.x.x","@hapi/lab":"20.x.x"},"scripts":{"test":"lab -t 100 -a @hapi/code -L","test-cov-html":"lab -r html -o coverage.html -a @hapi/code"},"license":"BSD-3-Clause"}'); /***/ }),