@depup/mammoth 1.12.2-depup.0 → 1.13.0-depup.0

package/.eslintrc.json

@@ -68,7 +68,10 @@
     "console": true,
     "exports": true,
     "module": true,
+    "process": false,
+    "Promise": false,
     "require": false,
+    "setTimeout": false,
     "TextDecoder": false,
     "Uint8Array": false
   }

package/NEWS

@@ -1,3 +1,37 @@
+# 1.13.0
+
+* Replace the use of bluebird with native promises.
+
+  This is arguably a breaking change: however, the return value of functions
+  such as convertToHtml() was only documented as a promise, rather than as a
+  bluebird promise.
+
+  The only exception is that the docs previously used .done(): therefore,
+  when returning promises from the API to external users, a done method is
+  added.
+
+  Any callers that rely on bluebird promises can convert the returned promise
+  into a bluebird promise using bluebird.Promise.resolve().
+
+* Read the children of w:customXml elements.
+
+* Handle paragraphs and runs that have been moved and tracked as a revision.
+
+* Improve escaping in Markdown writer. This avoids some cases where source
+  documents could inject arbitrary HTML into the converted document.
+
+# 1.12.3
+
+* Avoid excessive backtracking when parsing an unterminated string with many
+  escape sequences. The previous behaviour would allow maliciously crafted
+  documents to cause a denial of service.
+
+  Note that it is still strongly recommended to process untrusted documents in
+  a separate thread with a timeout to avoid potential similar issues.
+
+* Handle complex field separator and end characters without corresponding start
+  characters.
+
 # 1.12.2
 
 * Avoid prototype pollution when reading the styles defined in a document. This

package/README.md

@@ -13,20 +13,19 @@ npm install @depup/mammoth
 
 | Field | Value |
 |-------|-------|
-| Original | [mammoth](https://www.npmjs.com/package/mammoth) @ 1.12.2 |
-| Processed | 2026-08-28 |
+| Original | [mammoth](https://www.npmjs.com/package/mammoth) @ 1.13.0 |
+| Processed | 2026-09-27 |
 | Smoke test | passed |
-| Deps updated | 7 |
+| Deps updated | 6 |
 
 ## Dependency Changes
 
 | Dependency | From | To |
 |------------|------|-----|
 | @xmldom/xmldom | ^0.8.6 | ^0.9.12 |
-| argparse | ~1.0.3 | ^3.0.1 |
-| bluebird | ~3.4.0 | ^3.7.2 |
-| jszip | ^3.7.1 | ^3.10.1 |
-| path-is-absolute | ^1.0.0 | ^2.0.0 |
+| argparse | ~1.0.3 | ^3.0.2 |
+| dingbat-to-unicode | ^1.0.1 | ^1.0.2 |
+| jszip | ^3.7.1 | ^3.10.2 |
 | underscore | ^1.13.1 | ^1.13.8 |
 | xmlbuilder | ^10.0.0 | ^15.1.1 |
 

package/changes.json

@@ -6,19 +6,15 @@
     },
     "argparse": {
       "from": "~1.0.3",
-      "to": "^3.0.1"
+      "to": "^3.0.2"
     },
-    "bluebird": {
-      "from": "~3.4.0",
-      "to": "^3.7.2"
+    "dingbat-to-unicode": {
+      "from": "^1.0.1",
+      "to": "^1.0.2"
     },
     "jszip": {
       "from": "^3.7.1",
-      "to": "^3.10.1"
-    },
-    "path-is-absolute": {
-      "from": "^1.0.0",
-      "to": "^2.0.0"
+      "to": "^3.10.2"
     },
     "underscore": {
       "from": "^1.13.1",
@@ -29,6 +25,6 @@
       "to": "^15.1.1"
     }
   },
-  "timestamp": "2026-08-28T20:02:44.372Z",
-  "totalUpdated": 7
+  "timestamp": "2026-09-27T01:01:10.195Z",
+  "totalUpdated": 6
 }

package/lib/document-to-html.js

@@ -51,7 +51,7 @@ function DocumentConversion(options, comments) {
             }
         });
         var deferredValues = Object.create(null);
-        return promises.mapSeries(deferredNodes, function(deferred) {
+        return promises.forEachSeries(deferredNodes, function(deferred) {
             return deferred.value().then(function(value) {
                 deferredValues[deferred.id] = value;
             });
@@ -80,27 +80,27 @@ function DocumentConversion(options, comments) {
         });
     }
 
-    function convertElements(elements, messages, options) {
+    function convertElements(elements, messages, context) {
         return flatMap(elements, function(element) {
-            return elementToHtml(element, messages, options);
+            return elementToHtml(element, messages, context);
         });
     }
 
-    function elementToHtml(element, messages, options) {
-        if (!options) {
-            throw new Error("options not set");
+    function elementToHtml(element, messages, context) {
+        if (!context) {
+            throw new Error("context not set");
         }
         var handler = elementConverters[element.type];
         if (handler) {
-            return handler(element, messages, options);
+            return handler(element, messages, context);
         } else {
             return [];
         }
     }
 
-    function convertParagraph(element, messages, options) {
+    function convertParagraph(element, messages, context) {
         return htmlPathForParagraph(element, messages).wrap(function() {
-            var content = convertElements(element.children, messages, options);
+            var content = convertElements(element.children, messages, context);
             if (ignoreEmptyParagraphs) {
                 return content;
             } else {
@@ -122,9 +122,9 @@ function DocumentConversion(options, comments) {
         }
     }
 
-    function convertRun(run, messages, options) {
+    function convertRun(run, messages, context) {
         var nodes = function() {
-            return convertElements(run.children, messages, options);
+            return convertElements(run.children, messages, context);
         };
         var paths = [];
         if (run.highlight !== null) {
@@ -199,9 +199,9 @@ function DocumentConversion(options, comments) {
 
     function recoveringConvertImage(convertImage) {
         return function(image, messages) {
-            return promises.attempt(function() {
+            return promises.try(function() {
                 return convertImage(image, messages);
-            }).caught(function(error) {
+            }).catch(function(error) {
                 messages.push(results.error(error));
                 return [];
             });
@@ -232,13 +232,13 @@ function DocumentConversion(options, comments) {
         htmlPaths.element("table", {}, {fresh: true})
     ]);
 
-    function convertTable(element, messages, options) {
+    function convertTable(element, messages, context) {
         return findHtmlPath(element, defaultTablePath).wrap(function() {
-            return convertTableChildren(element, messages, options);
+            return convertTableChildren(element, messages, context);
         });
     }
 
-    function convertTableChildren(element, messages, options) {
+    function convertTableChildren(element, messages, context) {
         var bodyIndex = _.findIndex(element.children, function(child) {
             return !child.type === documents.types.tableRow || !child.isHeader;
         });
@@ -250,18 +250,18 @@ function DocumentConversion(options, comments) {
             children = convertElements(
                 element.children,
                 messages,
-                _.extend({}, options, {isTableHeader: false})
+                _.extend({}, context, {isTableHeader: false})
             );
         } else {
             var headRows = convertElements(
                 element.children.slice(0, bodyIndex),
                 messages,
-                _.extend({}, options, {isTableHeader: true})
+                _.extend({}, context, {isTableHeader: true})
             );
             var bodyRows = convertElements(
                 element.children.slice(bodyIndex),
                 messages,
-                _.extend({}, options, {isTableHeader: false})
+                _.extend({}, context, {isTableHeader: false})
             );
             children = [
                 Html.freshElement("thead", {}, headRows),
@@ -271,16 +271,16 @@ function DocumentConversion(options, comments) {
         return [Html.forceWrite].concat(children);
     }
 
-    function convertTableRow(element, messages, options) {
-        var children = convertElements(element.children, messages, options);
+    function convertTableRow(element, messages, context) {
+        var children = convertElements(element.children, messages, context);
         return [
             Html.freshElement("tr", {}, [Html.forceWrite].concat(children))
         ];
     }
 
-    function convertTableCell(element, messages, options) {
-        var tagName = options.isTableHeader ? "th" : "td";
-        var children = convertElements(element.children, messages, options);
+    function convertTableCell(element, messages, context) {
+        var tagName = context.isTableHeader ? "th" : "td";
+        var children = convertElements(element.children, messages, context);
         var attributes = {};
         if (element.colSpan !== 1) {
             attributes.colspan = element.colSpan.toString();
@@ -294,7 +294,7 @@ function DocumentConversion(options, comments) {
         ];
     }
 
-    function convertCommentReference(reference, messages, options) {
+    function convertCommentReference(reference, messages, context) {
         return findHtmlPath(reference, htmlPaths.ignore).wrap(function() {
             var comment = comments[reference.commentId];
             var count = referencedComments.length + 1;
@@ -310,12 +310,12 @@ function DocumentConversion(options, comments) {
         });
     }
 
-    function convertComment(referencedComment, messages, options) {
+    function convertComment(referencedComment, messages, context) {
         // TODO: remove duplication with note references
 
         var label = referencedComment.label;
         var comment = referencedComment.comment;
-        var body = convertElements(comment.body, messages, options).concat([
+        var body = convertElements(comment.body, messages, context).concat([
             Html.nonFreshElement("p", {}, [
                 Html.text(" "),
                 Html.freshElement("a", {"href": "#" + referenceHtmlId("comment", comment.commentId)}, [
@@ -334,7 +334,7 @@ function DocumentConversion(options, comments) {
         ];
     }
 
-    function convertBreak(element, messages, options) {
+    function convertBreak(element, messages, context) {
         return htmlPathForBreak(element).wrap(function() {
             return [];
         });
@@ -352,35 +352,35 @@ function DocumentConversion(options, comments) {
     }
 
     var elementConverters = {
-        "document": function(document, messages, options) {
-            var children = convertElements(document.children, messages, options);
+        "document": function(document, messages, context) {
+            var children = convertElements(document.children, messages, context);
             var notes = noteReferences.map(function(noteReference) {
                 return document.notes.resolve(noteReference);
             });
-            var notesNodes = convertElements(notes, messages, options);
+            var notesNodes = convertElements(notes, messages, context);
             return children.concat([
                 Html.freshElement("ol", {}, notesNodes),
                 Html.freshElement("dl", {}, flatMap(referencedComments, function(referencedComment) {
-                    return convertComment(referencedComment, messages, options);
+                    return convertComment(referencedComment, messages, context);
                 }))
             ]);
         },
         "paragraph": convertParagraph,
         "run": convertRun,
-        "text": function(element, messages, options) {
+        "text": function(element, messages, context) {
             return [Html.text(element.value)];
         },
-        "tab": function(element, messages, options) {
+        "tab": function(element, messages, context) {
             return [Html.text("\t")];
         },
-        "hyperlink": function(element, messages, options) {
+        "hyperlink": function(element, messages, context) {
             var href = element.anchor ? "#" + htmlId(element.anchor) : element.href;
             var attributes = {href: href};
             if (element.targetFrame != null) {
                 attributes.target = element.targetFrame;
             }
 
-            var children = convertElements(element.children, messages, options);
+            var children = convertElements(element.children, messages, context);
             return [Html.nonFreshElement("a", attributes, children)];
         },
         "checkbox": function(element) {
@@ -390,13 +390,13 @@ function DocumentConversion(options, comments) {
             }
             return [Html.freshElement("input", attributes)];
         },
-        "bookmarkStart": function(element, messages, options) {
+        "bookmarkStart": function(element, messages, context) {
             var anchor = Html.freshElement("a", {
                 id: htmlId(element.name)
             }, [Html.forceWrite]);
             return [anchor];
         },
-        "noteReference": function(element, messages, options) {
+        "noteReference": function(element, messages, context) {
             noteReferences.push(element);
             var anchor = Html.freshElement("a", {
                 href: "#" + noteHtmlId(element),
@@ -405,8 +405,8 @@ function DocumentConversion(options, comments) {
 
             return [Html.freshElement("sup", {}, [anchor])];
         },
-        "note": function(element, messages, options) {
-            var children = convertElements(element.body, messages, options);
+        "note": function(element, messages, context) {
+            var children = convertElements(element.body, messages, context);
             var backLink = Html.elementWithTag(htmlPaths.element("p", {}, {fresh: false}), [
                 Html.text(" "),
                 Html.freshElement("a", {href: "#" + noteRefHtmlId(element)}, [Html.text("↑")])
@@ -431,13 +431,13 @@ function DocumentConversion(options, comments) {
 var deferredId = 1;
 
 function deferredConversion(func) {
-    return function(element, messages, options) {
+    return function(element, messages, context) {
         return [
             {
                 type: "deferred",
                 id: deferredId++,
                 value: function() {
-                    return func(element, messages, options);
+                    return func(element, messages, context);
                 }
             }
         ];

package/lib/docx/body-reader.js

@@ -169,6 +169,12 @@ function BodyReader(options) {
             complexFieldStack.push({type: "begin", fldChar: element});
             currentInstrText = [];
         } else if (type === "end") {
+            if (complexFieldStack.length === 0) {
+                return emptyResultWithMessages([warning(
+                    "Ignoring complex field end character without corresponding start character"
+                )]);
+            }
+
             var complexFieldEnd = complexFieldStack.pop();
             if (complexFieldEnd.type === "begin") {
                 complexFieldEnd = parseCurrentInstrText(complexFieldEnd);
@@ -179,6 +185,12 @@ function BodyReader(options) {
                 }));
             }
         } else if (type === "separate") {
+            if (complexFieldStack.length === 0) {
+                return emptyResultWithMessages([warning(
+                    "Ignoring complex field separator character without corresponding start character"
+                )]);
+            }
+
             var complexFieldSeparate = complexFieldStack.pop();
             var complexField = parseCurrentInstrText(complexFieldSeparate);
             complexFieldStack.push(complexField);
@@ -431,7 +443,13 @@ function BodyReader(options) {
             });
         },
 
+        "w:customXml": readChildElements,
         "w:ins": readChildElements,
+        "w:moveFromRangeEnd": readChildElements,
+        "w:moveFromRangeStart": readChildElements,
+        "w:moveTo": readChildElements,
+        "w:moveToRangeEnd": readChildElements,
+        "w:moveToRangeStart": readChildElements,
         "w:object": readChildElements,
         "w:smartTag": readChildElements,
         "w:drawing": readChildElements,
@@ -711,6 +729,7 @@ var ignoreElements = {
     "w:del": true,
     "w:footnoteRef": true,
     "w:endnoteRef": true,
+    "w:moveFrom": true,
     "w:pPr": true,
     "w:rPr": true,
     "w:tblPr": true,

package/lib/docx/files.js

@@ -1,10 +1,10 @@
-var fs = require("fs");
 var url = require("url");
 var os = require("os");
 var dirname = require("path").dirname;
+var isAbsolutePath = require("path").isAbsolute;
 var resolvePath = require("path").resolve;
-var isAbsolutePath = require('path-is-absolute');
 
+var fs = require("../fs");
 var promises = require("../promises");
 
 
@@ -26,7 +26,7 @@ function Files(options) {
 
     function read(uri, encoding) {
         return resolveUri(uri).then(function(path) {
-            return readFile(path, encoding).caught(function(error) {
+            return fs.readFile(path, encoding).catch(function(error) {
                 var message = "could not open external image: '" + uri + "' (document directory: '" + base + "')\n" + error.message;
                 return promises.reject(new Error(message));
             });
@@ -50,9 +50,6 @@ function Files(options) {
 }
 
 
-var readFile = promises.promisify(fs.readFile.bind(fs));
-
-
 function uriToPath(uriString, platform) {
     if (!platform) {
         platform = os.platform();

package/lib/fs.js

@@ -0,0 +1,16 @@
+var fs = require("fs");
+
+var promises = require("./promises");
+
+function readFile(path, options) {
+    return promises.resolve(fs.promises.readFile(path, options));
+}
+
+function writeFile(path, data, options) {
+    return promises.resolve(fs.promises.writeFile(path, data, options));
+}
+
+exports.createWriteStream = fs.createWriteStream.bind(fs);
+exports.readFile = readFile;
+exports.readFileSync = fs.readFileSync.bind(fs);
+exports.writeFile = writeFile;

package/lib/images.js

@@ -7,7 +7,7 @@ exports.imgElement = imgElement;
 
 function imgElement(func) {
     return function(element, messages) {
-        return promises.when(func(element)).then(function(result) {
+        return promises.resolve(func(element)).then(function(result) {
             var attributes = {};
             if (element.altText) {
                 attributes.alt = element.altText;

package/lib/index.js

@@ -6,6 +6,7 @@ var DocumentConverter = require("./document-to-html").DocumentConverter;
 var convertElementToRawText = require("./raw-text").convertElementToRawText;
 var readStyle = require("./style-reader").readStyle;
 var readOptions = require("./options-reader").readOptions;
+var promises = require("./promises");
 var unzip = require("./unzip");
 var Result = require("./results").Result;
 
@@ -32,10 +33,11 @@ function convertToMarkdown(input, options) {
 function convert(input, options) {
     options = readOptions(options);
 
-    return unzip.openZip(input)
-        .tap(function(docxFile) {
+    var result = unzip.openZip(input)
+        .then(function(docxFile) {
             return docxStyleMap.readStyleMap(docxFile).then(function(styleMap) {
                 options.embeddedStyleMap = styleMap;
+                return docxFile;
             });
         })
         .then(function(docxFile) {
@@ -47,11 +49,15 @@ function convert(input, options) {
                     return convertDocumentToHtml(documentResult, options);
                 });
         });
+
+    return promises.toExternalPromise(result);
 }
 
 function readEmbeddedStyleMap(input) {
-    return unzip.openZip(input)
+    var result = unzip.openZip(input)
         .then(docxStyleMap.readStyleMap);
+
+    return promises.toExternalPromise(result);
 }
 
 function convertDocumentToHtml(documentResult, options) {
@@ -79,17 +85,22 @@ function parseStyleMap(styleMap) {
 
 
 function extractRawText(input) {
-    return unzip.openZip(input)
+    var result = unzip.openZip(input)
         .then(docxReader.read)
         .then(function(documentResult) {
             return documentResult.map(convertElementToRawText);
         });
+
+    return promises.toExternalPromise(result);
 }
 
 function embedStyleMap(input, styleMap) {
-    return unzip.openZip(input)
-        .tap(function(docxFile) {
-            return docxStyleMap.writeStyleMap(docxFile, styleMap);
+    var result = unzip.openZip(input)
+        .then(function(docxFile) {
+            return docxStyleMap.writeStyleMap(docxFile, styleMap)
+                .then(function() {
+                    return docxFile;
+                });
         })
         .then(function(docxFile) {
             return docxFile.toArrayBuffer();
@@ -104,6 +115,8 @@ function embedStyleMap(input, styleMap) {
                 }
             };
         });
+
+    return promises.toExternalPromise(result);
 }
 
 exports.styleMapping = function() {

package/lib/main.js

@@ -1,11 +1,11 @@
 /* global process */
 
-var fs = require("fs");
 var path = require("path");
 
 var mammoth = require("./");
-var promises = require("./promises");
+var fs = require("./fs");
 var images = require("./images");
+var promises = require("./promises");
 
 function main(argv) {
     var docxPath = argv["docx-path"];
@@ -14,7 +14,7 @@ function main(argv) {
     var outputFormat = argv.output_format;
     var styleMapPath = argv.style_map;
 
-    readStyleMap(styleMapPath).then(function(styleMap) {
+    var result = readStyleMap(styleMapPath).then(function(styleMap) {
         var options = {
             styleMap: styleMap,
             outputFormat: outputFormat
@@ -31,7 +31,7 @@ function main(argv) {
 
                 return element.read().then(function(imageBuffer) {
                     var imagePath = path.join(outputDir, filename);
-                    return promises.nfcall(fs.writeFile, imagePath, imageBuffer);
+                    return fs.writeFile(imagePath, imageBuffer);
                 }).then(function() {
                     return {src: filename};
                 });
@@ -49,12 +49,14 @@ function main(argv) {
 
                 outputStream.write(result.value);
             });
-    }).done();
+    });
+
+    promises.toExternalPromise(result).done();
 }
 
 function readStyleMap(styleMapPath) {
     if (styleMapPath) {
-        return promises.nfcall(fs.readFile, styleMapPath, "utf8");
+        return fs.readFile(styleMapPath, "utf8");
     } else {
         return promises.resolve(null);
     }