@automattic/vip 4.1.5 → 4.1.8

package/node_modules/cpu-features/build/config.gypi

@@ -2,23 +2,24 @@
 {
   "variables": {
     "use_ccache_win": 0,
-    "clang": 0,
-    "llvm_version": "0.0",
-    "gas_version": "2.38",
+    "clang": 1,
+    "llvm_version": "20.1",
     "node_enable_experimentals": "false",
     "node_prefix": "/",
     "node_install_npm": "true",
-    "node_install_corepack": "true",
+    "node_install_corepack": "false",
     "control_flow_guard": "false",
     "node_use_amaro": "true",
     "debug_node": "false",
     "debug_symbols": "false",
+    "build_type%": "Release",
     "error_on_warn": "false",
     "suppress_all_error_on_warn": "false",
     "use_prefix_to_find_headers": "false",
     "host_arch": "x64",
     "target_arch": "x64",
     "node_byteorder": "little",
+    "cargo_rust_target": "",
     "want_separate_host_toolset": 0,
     "node_use_node_snapshot": "true",
     "node_use_node_code_cache": "true",
@@ -28,7 +29,9 @@
     "enable_pgo_use": "false",
     "enable_lto": "false",
     "enable_thin_lto": "false",
+    "lto_jobs": "",
     "single_executable_application": "true",
+    "node_use_lief": "true",
     "node_with_ltcg": "false",
     "node_tag": "",
     "node_release_urlbase": "https://nodejs.org/download/release/",
@@ -37,8 +40,8 @@
     "node_no_browser_globals": "false",
     "node_shared": "false",
     "libdir": "lib",
-    "node_module_version": 137,
-    "shlib_suffix": "so.137",
+    "node_module_version": 147,
+    "shlib_suffix": "so.147",
     "asan": 0,
     "ubsan": 0,
     "coverage": "false",
@@ -50,17 +53,13 @@
       "lib/_http_incoming.js",
       "lib/_http_outgoing.js",
       "lib/_http_server.js",
-      "lib/_stream_duplex.js",
-      "lib/_stream_passthrough.js",
-      "lib/_stream_readable.js",
-      "lib/_stream_transform.js",
-      "lib/_stream_wrap.js",
-      "lib/_stream_writable.js",
       "lib/_tls_common.js",
       "lib/_tls_wrap.js",
       "lib/assert.js",
       "lib/assert/strict.js",
       "lib/async_hooks.js",
+      "lib/bench.js",
+      "lib/bench/reporters.js",
       "lib/buffer.js",
       "lib/child_process.js",
       "lib/cluster.js",
@@ -72,7 +71,9 @@
       "lib/dns.js",
       "lib/dns/promises.js",
       "lib/domain.js",
+      "lib/dtls.js",
       "lib/events.js",
+      "lib/ffi.js",
       "lib/fs.js",
       "lib/fs/promises.js",
       "lib/http.js",
@@ -83,7 +84,6 @@
       "lib/internal/abort_controller.js",
       "lib/internal/assert.js",
       "lib/internal/assert/assertion_error.js",
-      "lib/internal/assert/calltracker.js",
       "lib/internal/assert/myers_diff.js",
       "lib/internal/assert/utils.js",
       "lib/internal/async_context_frame.js",
@@ -91,6 +91,13 @@
       "lib/internal/async_local_storage/async_context_frame.js",
       "lib/internal/async_local_storage/async_hooks.js",
       "lib/internal/async_local_storage/run_scope.js",
+      "lib/internal/bench_runner/benchmark.js",
+      "lib/internal/bench_runner/benchmarks_stream.js",
+      "lib/internal/bench_runner/cli.js",
+      "lib/internal/bench_runner/harness.js",
+      "lib/internal/bench_runner/reporter/json.js",
+      "lib/internal/bench_runner/reporter/spec.js",
+      "lib/internal/bench_runner/runner.js",
       "lib/internal/blob.js",
       "lib/internal/blocklist.js",
       "lib/internal/bootstrap/node.js",
@@ -127,12 +134,14 @@
       "lib/internal/crypto/hashnames.js",
       "lib/internal/crypto/hkdf.js",
       "lib/internal/crypto/kem.js",
+      "lib/internal/crypto/kem_hybrids.js",
       "lib/internal/crypto/keygen.js",
       "lib/internal/crypto/keys.js",
       "lib/internal/crypto/mac.js",
       "lib/internal/crypto/ml_dsa.js",
       "lib/internal/crypto/ml_kem.js",
       "lib/internal/crypto/pbkdf2.js",
+      "lib/internal/crypto/provider_mac.js",
       "lib/internal/crypto/random.js",
       "lib/internal/crypto/rsa.js",
       "lib/internal/crypto/scrypt.js",
@@ -152,6 +161,10 @@
       "lib/internal/dns/callback_resolver.js",
       "lib/internal/dns/promises.js",
       "lib/internal/dns/utils.js",
+      "lib/internal/dtls/dtls.js",
+      "lib/internal/dtls/state.js",
+      "lib/internal/dtls/stats.js",
+      "lib/internal/dtls/symbols.js",
       "lib/internal/encoding.js",
       "lib/internal/encoding/single-byte.js",
       "lib/internal/encoding/util.js",
@@ -161,6 +174,9 @@
       "lib/internal/event_target.js",
       "lib/internal/events/abort_listener.js",
       "lib/internal/events/symbols.js",
+      "lib/internal/ffi-shared-buffer.js",
+      "lib/internal/ffi/fast-api.js",
+      "lib/internal/ffi/vfs.js",
       "lib/internal/file.js",
       "lib/internal/fixed_queue.js",
       "lib/internal/freelist.js",
@@ -195,6 +211,7 @@
       "lib/internal/legacy/processbinding.js",
       "lib/internal/linkedlist.js",
       "lib/internal/locks.js",
+      "lib/internal/main/bench_runner.js",
       "lib/internal/main/check_syntax.js",
       "lib/internal/main/embedding.js",
       "lib/internal/main/eval_stdin.js",
@@ -215,7 +232,6 @@
       "lib/internal/modules/esm/create_dynamic_module.js",
       "lib/internal/modules/esm/get_format.js",
       "lib/internal/modules/esm/hooks.js",
-      "lib/internal/modules/esm/initialize_import_meta.js",
       "lib/internal/modules/esm/load.js",
       "lib/internal/modules/esm/loader.js",
       "lib/internal/modules/esm/module_job.js",
@@ -273,6 +289,7 @@
       "lib/internal/repl.js",
       "lib/internal/repl/await.js",
       "lib/internal/repl/completion.js",
+      "lib/internal/repl/highlight.js",
       "lib/internal/repl/history.js",
       "lib/internal/repl/utils.js",
       "lib/internal/socket_list.js",
@@ -303,6 +320,7 @@
       "lib/internal/streams/iter/transform.js",
       "lib/internal/streams/iter/types.js",
       "lib/internal/streams/iter/utils.js",
+      "lib/internal/streams/iter/webidl.js",
       "lib/internal/streams/lazy_transform.js",
       "lib/internal/streams/legacy.js",
       "lib/internal/streams/operators.js",
@@ -339,23 +357,47 @@
       "lib/internal/tls/common.js",
       "lib/internal/tls/secure-context.js",
       "lib/internal/tls/wrap.js",
+      "lib/internal/trace_events.js",
       "lib/internal/trace_events_async_hooks.js",
       "lib/internal/tty.js",
       "lib/internal/url.js",
       "lib/internal/util.js",
       "lib/internal/util/colors.js",
       "lib/internal/util/comparisons.js",
+      "lib/internal/util/debounce.js",
       "lib/internal/util/debuglog.js",
       "lib/internal/util/diff.js",
       "lib/internal/util/inspect.js",
       "lib/internal/util/inspector.js",
       "lib/internal/util/parse_args/parse_args.js",
       "lib/internal/util/parse_args/utils.js",
+      "lib/internal/util/throttle.js",
       "lib/internal/util/trace_sigint.js",
       "lib/internal/util/types.js",
+      "lib/internal/v8/cpu_profiler.js",
+      "lib/internal/v8/heap_profile.js",
       "lib/internal/v8/startup_snapshot.js",
       "lib/internal/v8_prof_polyfill.js",
       "lib/internal/validators.js",
+      "lib/internal/vfs/dir.js",
+      "lib/internal/vfs/errors.js",
+      "lib/internal/vfs/fd.js",
+      "lib/internal/vfs/file_handle.js",
+      "lib/internal/vfs/file_system.js",
+      "lib/internal/vfs/provider.js",
+      "lib/internal/vfs/provider_registry.js",
+      "lib/internal/vfs/providers/composable.js",
+      "lib/internal/vfs/providers/memory.js",
+      "lib/internal/vfs/providers/real.js",
+      "lib/internal/vfs/providers/sea.js",
+      "lib/internal/vfs/providers/ziparchive.js",
+      "lib/internal/vfs/root.js",
+      "lib/internal/vfs/router.js",
+      "lib/internal/vfs/sea.js",
+      "lib/internal/vfs/setup.js",
+      "lib/internal/vfs/stats.js",
+      "lib/internal/vfs/streams.js",
+      "lib/internal/vfs/watcher.js",
       "lib/internal/vm.js",
       "lib/internal/vm/module.js",
       "lib/internal/wasm_web_api.js",
@@ -372,11 +414,26 @@
       "lib/internal/webstreams/transformstream.js",
       "lib/internal/webstreams/util.js",
       "lib/internal/webstreams/writablestream.js",
+      "lib/internal/webworker.js",
       "lib/internal/worker.js",
       "lib/internal/worker/clone_dom_exception.js",
       "lib/internal/worker/io.js",
       "lib/internal/worker/js_transferable.js",
       "lib/internal/worker/messaging.js",
+      "lib/internal/zip.js",
+      "lib/internal/zip/archive.js",
+      "lib/internal/zip/binary.js",
+      "lib/internal/zip/buffer.js",
+      "lib/internal/zip/compression.js",
+      "lib/internal/zip/constants.js",
+      "lib/internal/zip/content-size.js",
+      "lib/internal/zip/dos.js",
+      "lib/internal/zip/entry.js",
+      "lib/internal/zip/extra-fields.js",
+      "lib/internal/zip/file.js",
+      "lib/internal/zip/fs-util.js",
+      "lib/internal/zip/header-builders.js",
+      "lib/internal/zip/headers.js",
       "lib/module.js",
       "lib/net.js",
       "lib/os.js",
@@ -411,6 +468,7 @@
       "lib/util.js",
       "lib/util/types.js",
       "lib/v8.js",
+      "lib/vfs.js",
       "lib/vm.js",
       "lib/wasi.js",
       "lib/worker_threads.js",
@@ -425,10 +483,10 @@
       "test/cctest/test_base64.cc",
       "test/cctest/test_base_object_ptr.cc",
       "test/cctest/test_cppgc.cc",
-      "test/cctest/test_crypto_clienthello.cc",
       "test/cctest/test_dataqueue.cc",
       "test/cctest/test_diagnostics_channel.cc",
       "test/cctest/test_environment.cc",
+      "test/cctest/test_environment_shared_isolate.cc",
       "test/cctest/test_inspector_socket.cc",
       "test/cctest/test_inspector_socket_server.cc",
       "test/cctest/test_json_utils.cc",
@@ -452,6 +510,7 @@
       "test/cctest/test_report.cc",
       "test/cctest/test_sockaddr.cc",
       "test/cctest/test_string_bytes.cc",
+      "test/cctest/test_trace_event.cc",
       "test/cctest/test_traced_value.cc",
       "test/cctest/test_util.cc",
       "test/cctest/node_test_fixture.h"
@@ -460,20 +519,28 @@
     "node_shared_zlib": "false",
     "node_shared_http_parser": "false",
     "node_shared_libuv": "false",
+    "node_shared_abseil": "false",
     "node_shared_ada": "false",
     "node_shared_simdjson": "false",
     "node_shared_simdutf": "false",
     "node_shared_brotli": "false",
     "node_shared_cares": "false",
+    "node_shared_gtest_libraries": [],
     "node_shared_gtest": "false",
     "node_shared_hdr_histogram": "false",
+    "node_shared_highway": "false",
     "node_shared_merve": "false",
     "node_shared_nbytes": "false",
     "node_shared_nghttp2": "false",
     "node_shared_nghttp3": "false",
     "node_shared_ngtcp2": "false",
+    "node_shared_lief": "false",
+    "node_shared_perfetto": "false",
     "node_use_sqlite": "true",
     "node_shared_sqlite": "false",
+    "node_use_ffi": "true",
+    "node_shared_ffi": "false",
+    "node_shared_temporal_capi": "false",
     "node_shared_uvwasi": "false",
     "node_shared_zstd": "false",
     "v8_enable_webassembly": 1,
@@ -493,12 +560,15 @@
     "v8_enable_external_code_space": 0,
     "v8_enable_31bit_smis_on_64bit_arch": 0,
     "v8_enable_extensible_ro_snapshot": 0,
+    "v8_enable_temporal_support": 1,
     "v8_trace_maps": 0,
+    "v8_use_perfetto": 0,
     "node_use_v8_platform": "true",
     "node_use_bundled_v8": "true",
     "force_dynamic_crt": 0,
     "node_enable_d8": "false",
     "node_enable_v8windbg": "false",
+    "node_enable_v8debughelper": "false",
     "v8_enable_hugepage": 0,
     "v8_enable_short_builtin_calls": 1,
     "v8_enable_wasm_simd256_revec": 1,
@@ -507,10 +577,13 @@
     "openssl_is_fips": "false",
     "node_fipsinstall": "false",
     "node_without_node_options": "false",
-    "openssl_version": 810549391,
+    "openssl_version": 810549407,
     "openssl_is_boringssl": "false",
     "node_use_quic": "false",
+    "node_use_dtls": "false",
     "icu_small": "false",
+    "icu_system": "false",
+    "v8_enable_temporal_systemicu": 1,
     "v8_enable_i18n_support": 1,
     "icu_gyp_path": "tools/icu/icu-generic.gyp",
     "icu_path": "deps/icu-small",
@@ -524,36 +597,32 @@
       "deps/amaro/dist/index.js"
     ],
     "ossfuzz": "false",
-    "nodedir": "/home/runner/.cache/node-gyp/24.21.0",
+    "v8_enable_v8_checks": 0,
+    "nodedir": "/home/runner/.cache/node-gyp/26.13.0",
     "python": "/usr/bin/python3",
     "standalone_static_library": 1,
-    "global_prefix": "/opt/hostedtoolcache/node/24.21.0/x64",
+    "global_prefix": "/opt/hostedtoolcache/node/26.13.0/x64",
     "init_module": "/home/runner/.npm-init.js",
-    "globalconfig": "/opt/hostedtoolcache/node/24.21.0/x64/etc/npmrc",
+    "globalconfig": "/opt/hostedtoolcache/node/26.13.0/x64/etc/npmrc",
     "userconfig": "/home/runner/work/_temp/.npmrc",
-    "node_gyp": "/opt/hostedtoolcache/node/24.21.0/x64/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js",
+    "node_gyp": "/opt/hostedtoolcache/node/26.13.0/x64/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js",
     "cache": "/home/runner/.npm",
-    "npm_version": "11.20.0",
-    "prefix": "/opt/hostedtoolcache/node/24.21.0/x64",
+    "npm_version": "11.21.2",
+    "prefix": "/opt/hostedtoolcache/node/26.13.0/x64",
     "allow_git": "root",
     "local_prefix": "/home/runner/work/vip-cli/vip-cli",
-    "user_agent": "npm/11.20.0 node/v24.21.0 linux x64 workspaces/false ci/github-actions/dotcom-hosted"
+    "user_agent": "npm/11.21.2 node/v26.13.0 linux x64 workspaces/false ci/github-actions/dotcom-hosted"
   },
   "target_defaults": {
     "include_dirs": [],
     "libraries": [],
     "defines": [],
     "cflags": [],
+    "conditions": [],
     "default_configuration": "Release",
     "configurations": {
-      "Release": {
-        "variables": {},
-        "v8_enable_v8_checks": 0
-      },
-      "Debug": {
-        "variables": {},
-        "v8_enable_v8_checks": 1
-      }
+      "Release": {},
+      "Debug": {}
     }
   }
 }

package/node_modules/cpu-features/build/cpufeatures.target.mk

@@ -41,13 +41,13 @@ CFLAGS_CC_Debug := \
 	-std=gnu++20
 
 INCS_Debug := \
-	-I/home/runner/.cache/node-gyp/24.21.0/include/node \
-	-I/home/runner/.cache/node-gyp/24.21.0/src \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/zlib \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/v8/include \
+	-I/home/runner/.cache/node-gyp/26.13.0/include/node \
+	-I/home/runner/.cache/node-gyp/26.13.0/src \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/zlib \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/v8/include \
 	-I$(srcdir)/src \
 	-I$(srcdir)/../nan \
 	-I$(srcdir)/deps/cpu_features/include
@@ -89,13 +89,13 @@ CFLAGS_CC_Release := \
 	-std=gnu++20
 
 INCS_Release := \
-	-I/home/runner/.cache/node-gyp/24.21.0/include/node \
-	-I/home/runner/.cache/node-gyp/24.21.0/src \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/zlib \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/v8/include \
+	-I/home/runner/.cache/node-gyp/26.13.0/include/node \
+	-I/home/runner/.cache/node-gyp/26.13.0/src \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/zlib \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/v8/include \
 	-I$(srcdir)/src \
 	-I$(srcdir)/../nan \
 	-I$(srcdir)/deps/cpu_features/include

package/node_modules/cpu-features/build/deps/cpu_features/cpu_features.target.mk

@@ -41,13 +41,13 @@ CFLAGS_CC_Debug := \
 	-std=gnu++20
 
 INCS_Debug := \
-	-I/home/runner/.cache/node-gyp/24.21.0/include/node \
-	-I/home/runner/.cache/node-gyp/24.21.0/src \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/zlib \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/v8/include \
+	-I/home/runner/.cache/node-gyp/26.13.0/include/node \
+	-I/home/runner/.cache/node-gyp/26.13.0/src \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/zlib \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/v8/include \
 	-I$(srcdir)/deps/cpu_features/include \
 	-I$(srcdir)/deps/cpu_features/include/internal
 
@@ -88,13 +88,13 @@ CFLAGS_CC_Release := \
 	-std=gnu++20
 
 INCS_Release := \
-	-I/home/runner/.cache/node-gyp/24.21.0/include/node \
-	-I/home/runner/.cache/node-gyp/24.21.0/src \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/openssl/config \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/openssl/openssl/include \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/uv/include \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/zlib \
-	-I/home/runner/.cache/node-gyp/24.21.0/deps/v8/include \
+	-I/home/runner/.cache/node-gyp/26.13.0/include/node \
+	-I/home/runner/.cache/node-gyp/26.13.0/src \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/openssl/config \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/openssl/openssl/include \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/uv/include \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/zlib \
+	-I/home/runner/.cache/node-gyp/26.13.0/deps/v8/include \
 	-I$(srcdir)/deps/cpu_features/include \
 	-I$(srcdir)/deps/cpu_features/include/internal
 

package/node_modules/ejs/README.md

@@ -55,13 +55,18 @@ published CJS surface (`require('ejs')`) is unchanged. For Browserify,
 pass `--node` so it picks the `main` entry instead of the prebuilt UMD
 bundle pointed to by the `browser` field.
 
+Browser-targeted bundlers that support conditional exports select the prebuilt
+bundle through the `browser` export condition. Use this bundle to compile and
+render template strings; loading templates from the filesystem with `renderFile`
+requires the Node entry point.
+
 ## Features
 
   * Control flow with `<% %>`
   * Escaped output with `<%= %>` (escape function configurable)
   * Unescaped raw output with `<%- %>`
   * Newline-trim mode ('newline slurping') with `-%>` ending tag
-  * Whitespace-trim mode (slurp all whitespace) for control flow with `<%_ _%>`
+  * Whitespace-trim mode (slurp surrounding spaces and tabs) for control flow with `<%_ _%>`
   * Custom delimiters (e.g. `[? ?]` instead of `<% %>`)
   * Includes
   * Client-side support
@@ -92,12 +97,6 @@ ejs.renderFile(filename, data, options, function(err, str){
 });
 ```
 
-It is also possible to use `ejs.render(dataAndOptions);` where you pass
-everything in a single object. In that case, you'll end up with local variables
-for all the passed options. However, be aware that your code could break if we
-add an option with the same name as one of your data object's properties.
-Therefore, we do not recommend using this shortcut.
-
 ### Important
 You should never give end-users unfettered access to the EJS render method, If you do so you are using EJS in an inherently un-secure way.
 
@@ -127,12 +126,13 @@ You should never give end-users unfettered access to the EJS render method, If y
     the locals object, available even in strict mode.
   - `localsName`            Name to use for the object storing local variables when not using
     `with` Defaults to `locals`
-  - `rmWhitespace`          Remove all safe-to-remove whitespace, including leading
-    and trailing whitespace. It also enables a safer version of `-%>` line
-    slurping for all scriptlet tags (it does not strip new lines of tags in
-    the middle of a line).
+  - `rmWhitespace`          Remove all safe-to-remove whitespace: leading and
+    trailing whitespace on each line, and blank lines. Because trailing spaces
+    are removed first, `-%>` reliably trims the newline after a tag.
   - `escape`                The escaping function used with `<%=` construct.
-    (By default escapes XML).
+    (By default escapes XML.) See [Escaping and output
+    context](#escaping-and-output-context) for when the default is not the right
+    choice.
   - `outputFunctionName`    Set to a string (e.g., 'echo' or 'print') for a function to print
     output inside scriptlet tags.
   - `async`                 When `true`, EJS will use an async function for rendering. (Depends
@@ -151,17 +151,39 @@ the both the public & private API docs, run `jake devdoc` instead.
 ### Tags
 
   - `<%`              'Scriptlet' tag, for control-flow, no output
-  - `<%_`             'Whitespace Slurping' Scriptlet tag, strips all whitespace before it
+  - `<%_`             'Whitespace Slurping' Scriptlet tag, strips spaces and tabs before it
   - `<%=`             Outputs the value into the template (escaped)
   - `<%-`             Outputs the unescaped value into the template
   - `<%#`             Comment tag, no execution, no output
   - `<%%`             Outputs a literal '<%'
   - `%%>`             Outputs a literal '%>'
   - `%>`              Plain ending tag
-  - `-%>`             Trim-mode ('newline slurp') tag, trims following newline
-  - `_%>`             'Whitespace Slurping' ending tag, removes all whitespace after it
+  - `-%>`             Trim-mode ('newline slurp') tag, trims a newline directly after it
+  - `_%>`             'Whitespace Slurping' ending tag, removes spaces and tabs after it, then one newline
+
+### Escaping and output context
 
-For the full syntax documentation, please see [docs/syntax.md](https://github.com/mde/ejs/blob/master/docs/syntax.md).
+1. EJS is most often used to generate HTML.
+2. `<%= %>` reflects that. It escapes for HTML content and quoted attribute
+   values.
+3. EJS also generates arbitrary strings for other contexts, and knows nothing
+   about where its output ends up.
+4. You can replace the default escaping.
+5. Outside HTML content, you should.
+
+```javascript
+ejs.render(template, data, {escape: myEscapeFunction});
+```
+
+`escape` must go in the options argument. It cannot be set on `ejs` globally or
+passed in with the data. For a template that mixes contexts, escape per value
+with `<%- myEscapeFunction(name) %>` instead.
+
+The usual mistake is `<%= %>` inside a `<script>` block. Browsers do not decode
+HTML entities there, so the default escaping neither renders correctly nor
+protects you. Pass the value through an attribute and `JSON.parse` it instead of
+splicing it into JavaScript source. (`JSON.stringify` output is not safe there
+either. A `</script>` anywhere in your data ends the block early.)
 
 ### Includes
 
@@ -315,9 +337,9 @@ EJS ships with a full-featured CLI. Options are similar to those used in JavaScr
   - `-m / --delimiter CHARACTER`         Use CHARACTER with angle brackets for open/close (defaults to %).
   - `-p / --open-delimiter CHARACTER`    Use CHARACTER instead of left angle bracket to open.
   - `-c / --close-delimiter CHARACTER`   Use CHARACTER instead of right angle bracket to close.
-  - `-s / --strict`                      When set to `true`, generated function is in strict mode
-  - `-n / --no-with`                     Use 'locals' object for vars rather than using `with` (implies --strict).
-  - `-l / --locals-name`                 Name to use for the object storing local variables when not using `with`.
+  - `-s / --strict`                      Generate the function in strict mode (implies --no-with).
+  - `-n / --no-with`                     Use 'locals' object for vars rather than using `with`.
+  - `-l / --locals-name NAME`            Name to use for the object storing local variables when not using `with`.
   - `-w / --rm-whitespace`               Remove all safe-to-remove whitespace, including leading and trailing whitespace.
   - `-d / --debug`                       Outputs generated function body
   - `-h / --help`                        Display this help message.
@@ -327,34 +349,48 @@ Here are some examples of usage:
 
 ```shell
 $ ejs -p [ -c ] ./template_file.ejs -o ./output.html
-$ ejs ./test/fixtures/user.ejs name=Lerxst
+$ ejs -m $ ./test/fixtures/user.ejs name=Lerxst
 $ ejs -n -l _ ./some_template.ejs -f ./data_file.json
 ```
 
+### Arguments
+
+As of v7:
+
+  - The template file comes first. Any `name=value` data comes after it.
+  - Unknown options are an error.
+  - Short options can be grouped (`-sdw`) and take attached values (`-m$`).
+  - A value that starts with `-` needs `=`: `-o=-out.html`.
+  - `--` ends options, for example when a template's name starts with `-`.
+  - Exit status is 0 on success, 2 for a usage error, and 1 for a runtime error.
+
 ### Data input
 
-There is a variety of ways to pass the CLI data for rendering.
+Pass JSON data one way: stdin, a data file (`-f`), or a command-line option
+(`-i`). Using `-f` and `-i` together is an error. Stdin is only read when there's
+no `-f`, `-i`, or `name=value` data.
 
 Stdin:
 
 ```shell
-$ ./test/fixtures/user_data.json | ejs ./test/fixtures/user.ejs
-$ ejs ./test/fixtures/user.ejs < test/fixtures/user_data.json
+$ cat ./test/fixtures/user_data.json | ejs -m $ ./test/fixtures/user.ejs
+$ ejs -m $ ./test/fixtures/user.ejs < test/fixtures/user_data.json
 ```
 
 A data file:
 
 ```shell
-$ ejs ./test/fixtures/user.ejs -f ./user_data.json
+$ ejs -m $ ./test/fixtures/user.ejs -f ./test/fixtures/user_data.json
 ```
 
 A command-line option (must be URI-encoded):
 
 ```shell
-./bin/cli.js -i %7B%22name%22%3A%20%22foo%22%7D ./test/fixtures/user.ejs
+./bin/cli.js -m $ -i %7B%22name%22%3A%20%22foo%22%7D ./test/fixtures/user.ejs
 ```
 
-Or, passing values directly at the end of the invocation:
+Or, passing `name=value` pairs after the template. These override values from
+`-f` or `-i`, and are always strings:
 
 ```shell
 ./bin/cli.js -m $ ./test/fixtures/user.ejs name=foo
@@ -362,8 +398,8 @@ Or, passing values directly at the end of the invocation:
 
 ### Output
 
-The CLI by default send output to stdout, but you can use the `-o` or `--output-file`
-flag to specify a target file to send the output to.
+The CLI sends output to stdout by default. Use `-o` or `--output-file` to write
+it to a file instead.
 
 ## IDE Integration with Syntax Highlighting