@autobusal/utilities 1.5.1 → 1.5.3

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 1.5.3
+
+### Fixed
+
+- **The backtick guard tripped on prose about styled-components**, and was refusing to publish the whole repo. Its opening pattern matches `styled.x` followed by a backtick as *text*, so a JSDoc line describing another file - "labels as `<span>` (Viewer/styles.ts: `Label = styled.span`)" - opened a template no code had opened, and every comment up to the next `` `; `` in the file counted as inside it. A comment about the hazard tripping the guard against the hazard. Openings found inside comments are now ignored; backticks inside comments, which are the thing being hunted, still are not.
+
+## 1.5.2
+
+### Changed
+
+- DOMPurify raised to `^3.4.14` for GHSA-55q2-fjhq-7xh7. It rates as moderate, which understates it here: DOMPurify is what `sanitizeHtml` is, so it sits directly on the path every piece of admin-authored and model-generated HTML takes before reaching a browser.
+
 ## 1.5.1
 
 ### Changed

package/check-backticks.mjs

@@ -52,10 +52,44 @@ const walk = (dir) => readdirSync(dir).flatMap((entry) => {
 
 const found = [];
 
+/**
+ * Where the comments are, as [start, end) offsets.
+ *
+ * Edited: Claude - Date: 2026-08-21
+ *
+ * Needed because OPEN matches `styled.x` + a backtick as TEXT, and prose
+ * about styled-components looks exactly like styled-components. A JSDoc
+ * line reading "labels as <span> (Viewer/styles.ts: `Label = styled.span`)"
+ * opened a template here that no code ever opened, and everything up to the
+ * next `; in the file - thirty-six lines of unrelated JSDoc - was then
+ * inside it. That is what refused to publish this repo: a comment ABOUT the
+ * hazard tripping the guard against the hazard.
+ *
+ * Comments cannot simply be stripped first: backticks in comments are the
+ * whole thing being looked for. Only the OPENING has to ignore them.
+ */
+const commentRanges = (text) => {
+  const ranges = [];
+  const pattern = /\/\*[\s\S]*?\*\/|\/\/[^\n]*/g;
+
+  for (const match of text.matchAll(pattern)) {
+    ranges.push([match.index, match.index + match[0].length]);
+  }
+
+  return ranges;
+};
+
 for (const path of walk(process.argv[2] ?? 'packages')) {
   const text = readFileSync(path, 'utf8');
+  const comments = commentRanges(text);
+  const commented = (at) => comments.some(([from, to]) => at >= from && at < to);
 
   for (const match of text.matchAll(OPEN)) {
+    // a styled template named inside a comment is prose, not a template
+    if (commented(match.index)) {
+      continue;
+    }
+
     const start = match.index + match[0].length;
     const end = text.indexOf('`;', start);
 

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@autobusal/utilities",
-  "version": "1.5.1",
+  "version": "1.5.3",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts",
   "dependencies": {
-    "dompurify": "^3.4.12"
+    "dompurify": "^3.4.14"
   }
 }