@depup/express-validator 7.3.1-depup.1

package/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2010 Chris O'Hara <cohara87@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/README.md

@@ -0,0 +1,32 @@
+# @depup/express-validator
+
+> Dependency-bumped version of [express-validator](https://www.npmjs.com/package/express-validator)
+
+Generated by [DepUp](https://github.com/depup/npm) -- all production
+dependencies bumped to latest versions.
+
+## Installation
+
+```bash
+npm install @depup/express-validator
+```
+
+| Field | Value |
+|-------|-------|
+| Original | [express-validator](https://www.npmjs.com/package/express-validator) @ 7.3.1 |
+| Processed | 2026-03-31 |
+| Smoke test | passed |
+| Deps updated | 2 |
+
+## Dependency Changes
+
+| Dependency | From | To |
+|------------|------|-----|
+| lodash | ^4.17.21 | ^4.18.0 |
+| validator | ~13.15.23 | ^13.15.26 |
+
+---
+
+Source: https://github.com/depup/npm | Original: https://www.npmjs.com/package/express-validator
+
+License inherited from the original package.

package/changes.json

@@ -0,0 +1,14 @@
+{
+  "bumped": {
+    "lodash": {
+      "from": "^4.17.21",
+      "to": "^4.18.0"
+    },
+    "validator": {
+      "from": "~13.15.23",
+      "to": "^13.15.26"
+    }
+  },
+  "timestamp": "2026-03-31T20:24:01.128Z",
+  "totalUpdated": 2
+}

package/lib/base.d.ts

@@ -0,0 +1,187 @@
+import { ReadonlyContext } from './context';
+export interface Request {
+    [k: string]: any;
+    body?: any;
+    cookies?: Record<string, any>;
+    headers?: Record<string, any>;
+    params?: Record<string, any>;
+    query?: Record<string, any>;
+}
+export type Middleware = (req: Request, res: any, next: (err?: any) => void) => void;
+export type Location = 'body' | 'cookies' | 'headers' | 'params' | 'query';
+/**
+ * Metadata about a validated field.
+ */
+export type Meta = {
+    /**
+     * The express request from which the field was validated
+     */
+    req: Request;
+    /**
+     * Which of the request objects the field was picked from
+     */
+    location: Location;
+    /**
+     * The full path of the field within the request object.
+     *
+     * @example
+     * const meta = { req, location: 'body', path: 'foo.bar' }; // req.body.foo.bar
+     */
+    path: string;
+    /**
+     * Values from wildcards/globstars used when selecting fields for validation.
+     *
+     * @example
+     * body('products.*.price').custom((value, { req, pathValues }) => {
+     *  const index = pathValues[0];
+     *  const productName = req.body.products[index].name;
+     * });
+     */
+    pathValues: readonly (string | string[])[];
+};
+/**
+ * A function which may
+ * - return falsy values, a promise that rejects or throw to indicate that a field is invalid;
+ * - return truthy values or a promise that resolves to indicate that a field is valid.
+ *
+ * @param input the field value
+ * @param meta metadata about the field being validated
+ */
+export type CustomValidator = (input: any, meta: Meta) => any;
+export type StandardValidator = (input: string, ...options: any[]) => boolean;
+export type CustomSanitizer = (input: any, meta: Meta) => any;
+export type StandardSanitizer = (input: string, ...options: any[]) => any;
+export interface FieldInstance {
+    path: string;
+    originalPath: string;
+    pathValues: readonly (string | string[])[];
+    location: Location;
+    value: any;
+}
+export type UnknownFieldInstance = Omit<FieldInstance, 'originalPath' | 'pathValues'>;
+export type FieldValidationError = {
+    /**
+     * Indicates that the error occurred because a field had an invalid value
+     */
+    type: 'field';
+    /**
+     * The location within the request where this field is
+     */
+    location: Location;
+    /**
+     * The path to the field which has a validation error
+     */
+    path: string;
+    /**
+     * The value of the field. It might be unset if the value is hidden.
+     */
+    value?: any;
+    /**
+     * The error message
+     */
+    msg: any;
+};
+export type UnknownFieldsError = {
+    /**
+     * Indicates that the error occurred because one or more fields are unknown in the request
+     */
+    type: 'unknown_fields';
+    /**
+     * The error message
+     */
+    msg: any;
+    /**
+     * The list of fields that are unknown
+     */
+    fields: UnknownFieldInstance[];
+};
+export type AlternativeValidationError = {
+    /**
+     * Indicates that the error occurred because all alternatives (e.g. in `oneOf()`) were invalid
+     */
+    type: 'alternative';
+    /**
+     * The error message
+     */
+    msg: any;
+    /**
+     * The list of underlying validation errors returned by validation chains in `oneOf()`
+     */
+    nestedErrors: FieldValidationError[];
+};
+export type GroupedAlternativeValidationError = {
+    /**
+     * Indicates that the error occurred because all alternatives (e.g. in `oneOf()`) were invalid,
+     * and the nested errors are grouped per alternative.
+     */
+    type: 'alternative_grouped';
+    /**
+     * The error message
+     */
+    msg: any;
+    /**
+     * The list of underlying validation errors returned by validation chains in `oneOf()`
+     */
+    nestedErrors: FieldValidationError[][];
+};
+/**
+ * A validation error as reported by a middleware.
+ * The properties available in the error object vary according to the type.
+ *
+ * @example
+ *  if (error.type === 'alternative') {
+ *    console.log(`There are ${error.nestedErrors.length} errors under this alternative list`);
+ *  } else if (error.type === 'field') {
+ *    console.log(`There's an error with field ${error.path} in the request ${error.location}`);
+ *  }
+ *
+ */
+export type ValidationError = AlternativeValidationError | GroupedAlternativeValidationError | UnknownFieldsError | FieldValidationError;
+/**
+ * An error message that's not a function, as these are treated as message factories
+ * by all validation middlewares.
+ */
+export type ErrorMessage = string | number | symbol | boolean | object | any[];
+/**
+ * A function which creates an error message based on a field's value.
+ *
+ * @param input the field value
+ * @param meta metadata about the field that was validated
+ */
+export type FieldMessageFactory = (value: any, meta: Meta) => any;
+/**
+ * A function which creates an error message based on an alternative's nested errors.
+ *
+ * @see `oneOf()`
+ * @param nestedErrors The errors from the invalid alternative(s).
+ * @param opts
+ */
+export type AlternativeMessageFactory = (nestedErrors: FieldValidationError[], opts: {
+    req: Request;
+}) => any;
+/**
+ * A function which creates an error message based on a group of alternatives nested errors.
+ *
+ * @see `oneOf()`
+ * @param nestedErrors The errors from the invalid alternative groups.
+ * @param opts
+ */
+export type GroupedAlternativeMessageFactory = (nestedErrors: FieldValidationError[][], opts: {
+    req: Request;
+}) => any;
+/**
+ * A function which creates an error message based on unknown fields.
+ *
+ * @see `checkExact()`
+ * @param unknownFields The unknown fields found in the request
+ * @param opts
+ */
+export type UnknownFieldMessageFactory = (unknownFields: UnknownFieldInstance[], opts: {
+    req: Request;
+}) => any;
+export declare const contextsKey = "express-validator#contexts";
+export interface InternalRequest extends Request {
+    [contextsKey]?: ReadonlyContext[];
+}
+export declare class ValidationHalt extends Error {
+}

package/lib/base.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ValidationHalt = exports.contextsKey = void 0;
+// Not using Symbol because of #813
+exports.contextsKey = 'express-validator#contexts';
+class ValidationHalt extends Error {
+}
+exports.ValidationHalt = ValidationHalt;

package/lib/chain/context-handler-impl.d.ts

@@ -0,0 +1,13 @@
+import { ContextBuilder } from '../context-builder';
+import { CustomValidator } from '../base';
+import { BailOptions, ContextHandler, OptionalOptions } from './context-handler';
+import { ContextRunner } from './context-runner';
+export declare class ContextHandlerImpl<Chain> implements ContextHandler<Chain> {
+    private readonly builder;
+    private readonly chain;
+    constructor(builder: ContextBuilder, chain: Chain);
+    bail(opts?: BailOptions): Chain;
+    if(condition: CustomValidator | ContextRunner): Chain;
+    optional(options?: OptionalOptions | boolean): Chain;
+    hide(hiddenValue?: string): Chain;
+}

package/lib/chain/context-handler-impl.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContextHandlerImpl = void 0;
+const context_items_1 = require("../context-items");
+const bail_1 = require("../context-items/bail");
+class ContextHandlerImpl {
+    constructor(builder, chain) {
+        this.builder = builder;
+        this.chain = chain;
+    }
+    bail(opts) {
+        if (opts?.level === 'request') {
+            this.builder.setRequestBail();
+        }
+        this.builder.addItem(new bail_1.Bail());
+        return this.chain;
+    }
+    if(condition) {
+        if ('run' in condition) {
+            this.builder.addItem(new context_items_1.ChainCondition(condition));
+        }
+        else if (typeof condition === 'function') {
+            this.builder.addItem(new context_items_1.CustomCondition(condition));
+        }
+        else {
+            throw new Error('express-validator: condition is not a validation chain nor a function');
+        }
+        return this.chain;
+    }
+    optional(options = true) {
+        let value;
+        if (typeof options === 'boolean') {
+            value = options ? 'undefined' : false;
+        }
+        else {
+            value = options.values
+                ? options.values
+                : options.checkFalsy
+                    ? 'falsy'
+                    : options.nullable
+                        ? 'null'
+                        : 'undefined';
+        }
+        this.builder.setOptional(value);
+        return this.chain;
+    }
+    hide(hiddenValue) {
+        this.builder.setHidden(true, hiddenValue);
+        return this.chain;
+    }
+}
+exports.ContextHandlerImpl = ContextHandlerImpl;

package/lib/chain/context-handler.d.ts

@@ -0,0 +1,110 @@
+import { CustomValidator } from '../base';
+import { Optional } from '../context';
+import { ContextRunner } from './context-runner';
+export interface BailOptions {
+    /**
+     * Defines the level at which to stop running further validations:
+     * - When set to `chain`, further validations won't be run for this validation chain if there
+     *   are any errors.
+     * - When set to `request`, no further validations on the same request will be run either if
+     *   there are any errors.
+     *
+     * @default 'chain'
+     */
+    level?: 'chain' | 'request';
+}
+export interface OptionalOptions {
+    /**
+     * Defines which kind of value makes a field optional.
+     *
+     * - `undefined`: only `undefined` values; equivalent to `value === undefined`
+     * - `null`: only `undefined` and `null` values; equivalent to `value == null`
+     * - `falsy`: all falsy values; equivalent to `!value`
+     *
+     * @default 'undefined'
+     */
+    values?: Exclude<Optional, false>;
+    /**
+     * Whether a field whose value is `null` or `undefined` is to be considered optional.
+     * @default false
+     * @deprecated  Use `values` instead.
+     */
+    nullable?: boolean;
+    /**
+     * Whether a field whose value is falsy (that is, `0`, `false`, `null`, `undefined` or an empty
+     * string) is to be considered optional.
+     * @default false
+     * @deprecated  Use `values` instead.
+     */
+    checkFalsy?: boolean;
+}
+export interface ContextHandler<Chain> {
+    /**
+     * Stops running validations if any of the previous ones have failed.
+     *
+     * Useful to prevent a custom validator that touches a database or external API from running when
+     * you know it will fail.
+     *
+     * May be used multiple times in the same validation chain if desired.
+     *
+     * @example
+     *  check('username')
+     *    .isEmail()
+     *    // If not an email, stop here
+     *    .bail()
+     *    .custom(checkDenylistDomain)
+     *    // If domain is not allowed, don't go check if it already exists
+     *    .bail()
+     *    .custom(checkEmailExists)
+     *
+     * @returns the current validation chain
+     */
+    bail(opts?: BailOptions): Chain;
+    /**
+     * Adds a condition on whether the validation should continue on a field or not.
+     * @param condition may be either
+     *  - a custom validator-like function, which must truthy or a promise that resolves to continue
+     *    validation. If the return value is falsy, a promise that rejects, or if it throws, validation
+     *    will stop.
+     * - a validation chain which if it would produce errors, the validation chain stops.
+     * @example
+     *  check('newPassword')
+     *    // Only validate if the old password has been provided
+     *    .if((value, { req }) => req.body.oldPassword)
+     *    // Or, use it with a a validation chain
+     *    .if(body('oldPassword').notEmpty())
+     * @returns the current validation chain
+     */
+    if(condition: CustomValidator | ContextRunner): Chain;
+    /**
+     * Marks the field(s) of the validation chain as optional.
+     * By default, only fields with an `undefined` value are considered optional and will be ignored
+     * when validating.
+     *
+     * @param options an object of options to customize the behavior of optional.
+     * @returns the current validation chain
+     */
+    optional(options?: {
+        values?: Optional;
+        /**
+         * @deprecated use `values` instead
+         */
+        checkFalsy?: boolean;
+        /**
+         * @deprecated use `values` instead
+         */
+        nullable?: boolean;
+    } | boolean): Chain;
+    /**
+     * Hide the field's value in errors returned by `validationResult()`.
+     *
+     * If the value is confidential information (such as api key),
+     * you might want to call this method to prevent exposing it.
+     *
+     * @param hiddenValue? String to replace the field's value with.
+     *   If it's not set, the field value is removed from errors.
+     *
+     * @returns the current validation chain
+     */
+    hide(hiddenValue?: string): Chain;
+}

package/lib/chain/context-handler.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/chain/context-runner-impl.d.ts

@@ -0,0 +1,18 @@
+import { Request } from '../base';
+import { Context, ReadonlyContext } from '../context';
+import { ContextBuilder } from '../context-builder';
+import { SelectFields } from '../field-selection';
+import { Result } from '../validation-result';
+import { ContextRunner, ResultWithContext } from './context-runner';
+export declare class ResultWithContextImpl extends Result implements ResultWithContext {
+    readonly context: ReadonlyContext;
+    constructor(context: ReadonlyContext);
+}
+export declare class ContextRunnerImpl implements ContextRunner {
+    private readonly builderOrContext;
+    private readonly selectFields;
+    constructor(builderOrContext: ContextBuilder | Context, selectFields?: SelectFields);
+    run(req: Request, options?: {
+        dryRun?: boolean;
+    }): Promise<ResultWithContextImpl>;
+}

package/lib/chain/context-runner-impl.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContextRunnerImpl = exports.ResultWithContextImpl = void 0;
+const _ = require("lodash");
+const base_1 = require("../base");
+const context_1 = require("../context");
+const field_selection_1 = require("../field-selection");
+const validation_result_1 = require("../validation-result");
+class ResultWithContextImpl extends validation_result_1.Result {
+    constructor(context) {
+        super(error => error, context.errors);
+        this.context = context;
+    }
+}
+exports.ResultWithContextImpl = ResultWithContextImpl;
+class ContextRunnerImpl {
+    constructor(builderOrContext, selectFields = field_selection_1.selectFields) {
+        this.builderOrContext = builderOrContext;
+        this.selectFields = selectFields;
+    }
+    async run(req, options = {}) {
+        const context = this.builderOrContext instanceof context_1.Context
+            ? this.builderOrContext
+            : this.builderOrContext.build();
+        const internalReq = req;
+        const bail = internalReq[base_1.contextsKey]?.some(context => context.bail && context.errors.length > 0);
+        if (bail) {
+            return new ResultWithContextImpl(context);
+        }
+        const instances = this.selectFields(req, context.fields, context.locations);
+        context.addFieldInstances(instances);
+        const haltedInstances = new Set();
+        for (const contextItem of context.stack) {
+            const promises = context.getData({ requiredOnly: true }).map(async (instance) => {
+                const { location, path } = instance;
+                const instanceKey = `${location}:${path}`;
+                if (haltedInstances.has(instanceKey)) {
+                    return;
+                }
+                try {
+                    await contextItem.run(context, instance.value, {
+                        req,
+                        location,
+                        path,
+                        pathValues: instance.pathValues,
+                    });
+                    // An instance is mutable, so if an item changed its value, there's no need to call getData again
+                    const newValue = instance.value;
+                    // Checks whether the value changed.
+                    // Avoids e.g. undefined values being set on the request if it didn't have the key initially.
+                    const reqValue = path !== '' ? _.get(req[location], path) : req[location];
+                    if (!options.dryRun && reqValue !== instance.value) {
+                        path !== '' ? _.set(req[location], path, newValue) : _.set(req, location, newValue);
+                    }
+                }
+                catch (e) {
+                    if (e instanceof base_1.ValidationHalt) {
+                        haltedInstances.add(instanceKey);
+                        return;
+                    }
+                    throw e;
+                }
+            });
+            await Promise.all(promises);
+        }
+        if (!options.dryRun) {
+            internalReq[base_1.contextsKey] = (internalReq[base_1.contextsKey] || []).concat(context);
+        }
+        return new ResultWithContextImpl(context);
+    }
+}
+exports.ContextRunnerImpl = ContextRunnerImpl;

package/lib/chain/context-runner.d.ts

@@ -0,0 +1,22 @@
+import { Request, ValidationError } from '../base';
+import { ReadonlyContext } from '../context';
+import { Result } from '../validation-result';
+export type ContextRunningOptions = {
+    /**
+     * Defines whether errors and sanitization should be persisted to `req`.
+     * @default false
+     */
+    dryRun?: boolean;
+};
+export interface ResultWithContext extends Result<ValidationError> {
+    readonly context: ReadonlyContext;
+}
+export interface ContextRunner {
+    /**
+     * Runs the current validation chain.
+     * @param req the express request to validate
+     * @param options an object of options to customize how the chain will be run
+     * @returns a promise for a {@link Result} that resolves when the validation chain has finished
+     */
+    run(req: Request, options?: ContextRunningOptions): Promise<ResultWithContext>;
+}

package/lib/chain/context-runner.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/chain/index.d.ts

@@ -0,0 +1,9 @@
+export * from './sanitizers';
+export * from './sanitizers-impl';
+export * from './context-handler';
+export * from './context-handler-impl';
+export * from './context-runner';
+export * from './context-runner-impl';
+export * from './validators';
+export * from './validators-impl';
+export * from './validation-chain';

package/lib/chain/index.js

@@ -0,0 +1,25 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./sanitizers"), exports);
+__exportStar(require("./sanitizers-impl"), exports);
+__exportStar(require("./context-handler"), exports);
+__exportStar(require("./context-handler-impl"), exports);
+__exportStar(require("./context-runner"), exports);
+__exportStar(require("./context-runner-impl"), exports);
+__exportStar(require("./validators"), exports);
+__exportStar(require("./validators-impl"), exports);
+__exportStar(require("./validation-chain"), exports);

package/lib/chain/sanitizers-impl.d.ts

@@ -0,0 +1,29 @@
+import { CustomSanitizer } from '../base';
+import { ContextBuilder } from '../context-builder';
+import * as Options from '../options';
+import { Sanitizers } from './sanitizers';
+export declare class SanitizersImpl<Chain> implements Sanitizers<Chain> {
+    private readonly builder;
+    private readonly chain;
+    constructor(builder: ContextBuilder, chain: Chain);
+    customSanitizer(sanitizer: CustomSanitizer): Chain;
+    default(default_value: any): Chain;
+    replace(values_to_replace: any, new_value: any): Chain;
+    private addStandardSanitization;
+    blacklist(chars: string): Chain;
+    escape(): Chain;
+    unescape(): Chain;
+    ltrim(chars?: string): Chain;
+    normalizeEmail(options?: Options.NormalizeEmailOptions): Chain;
+    rtrim(chars?: string): Chain;
+    stripLow(keep_new_lines?: boolean): Chain;
+    toArray(): Chain;
+    toBoolean(strict?: boolean): Chain;
+    toDate(): Chain;
+    toFloat(): Chain;
+    toInt(radix?: number): Chain;
+    toLowerCase(): Chain;
+    toUpperCase(): Chain;
+    trim(chars?: string): Chain;
+    whitelist(chars: string): Chain;
+}