@depup/webpack 5.106.0-depup.0 → 5.109.0-depup.0

package/lib/cli.js

@@ -7,7 +7,9 @@
 
 const path = require("path");
 const tty = require("tty");
-const webpackSchema = require("../schemas/WebpackOptions.json");
+const webpackSchema =
+	/** @type {EXPECTED_ANY} */
+	(require("../schemas/WebpackOptions.json"));
 
 /** @typedef {import("json-schema").JSONSchema4} JSONSchema4 */
 /** @typedef {import("json-schema").JSONSchema6} JSONSchema6 */
@@ -15,18 +17,20 @@ const webpackSchema = require("../schemas/WebpackOptions.json");
 /** @typedef {JSONSchema4 | JSONSchema6 | JSONSchema7} JSONSchema */
 /** @typedef {JSONSchema & { absolutePath: boolean, instanceof: string, cli: { helper?: boolean, exclude?: boolean, description?: string, negatedDescription?: string, resetDescription?: string } }} Schema */
 
-// TODO add originPath to PathItem for better errors
 /**
+ * Defines the path item type used by this module.
  * @typedef {object} PathItem
  * @property {Schema} schema the part of the schema
  * @property {string} path the path in the config
+ * @property {string} segment the JSON pointer segment of this schema part (absolute when starting with "#")
  */
 
-/** @typedef {"unknown-argument" | "unexpected-non-array-in-path" | "unexpected-non-object-in-path" | "multiple-values-unexpected" | "invalid-value"} ProblemType */
+/** @typedef {"unknown-argument" | "unexpected-non-array-in-path" | "unexpected-non-object-in-path" | "prototype-pollution-in-path" | "multiple-values-unexpected" | "invalid-value"} ProblemType */
 
 /** @typedef {string | number | boolean | RegExp} Value */
 
 /**
+ * Defines the problem type used by this module.
  * @typedef {object} Problem
  * @property {ProblemType} type
  * @property {string} path
@@ -37,6 +41,7 @@ const webpackSchema = require("../schemas/WebpackOptions.json");
  */
 
 /**
+ * Defines the local problem type used by this module.
  * @typedef {object} LocalProblem
  * @property {ProblemType} type
  * @property {string} path
@@ -48,6 +53,7 @@ const webpackSchema = require("../schemas/WebpackOptions.json");
 /** @typedef {string | number | boolean | EnumValueObject | EnumValueArray | null} EnumValue */
 
 /**
+ * Defines the argument config type used by this module.
  * @typedef {object} ArgumentConfig
  * @property {string=} description
  * @property {string=} negatedDescription
@@ -60,6 +66,7 @@ const webpackSchema = require("../schemas/WebpackOptions.json");
 /** @typedef {"string" | "number" | "boolean"} SimpleType */
 
 /**
+ * Defines the argument type used by this module.
  * @typedef {object} Argument
  * @property {string | undefined} description
  * @property {SimpleType} simpleType
@@ -72,6 +79,7 @@ const webpackSchema = require("../schemas/WebpackOptions.json");
 /** @typedef {Record<string, EXPECTED_ANY>} ObjectConfiguration */
 
 /**
+ * Returns object of arguments.
  * @param {Schema=} schema a json schema to create arguments for (by default webpack schema is used)
  * @returns {Flags} object of arguments
  */
@@ -80,6 +88,7 @@ const getArguments = (schema = webpackSchema) => {
 	const flags = {};
 
 	/**
+	 * Path to argument name.
 	 * @param {string} input input
 	 * @returns {string} result
 	 */
@@ -95,6 +104,7 @@ const getArguments = (schema = webpackSchema) => {
 			.toLowerCase();
 
 	/**
+	 * Returns schema part.
 	 * @param {string} path path
 	 * @returns {Schema} schema part
 	 */
@@ -117,6 +127,7 @@ const getArguments = (schema = webpackSchema) => {
 	};
 
 	/**
+	 * Returns description.
 	 * @param {PathItem[]} path path in the schema
 	 * @returns {string | undefined} description
 	 */
@@ -131,6 +142,7 @@ const getArguments = (schema = webpackSchema) => {
 	};
 
 	/**
+	 * Gets negated description.
 	 * @param {PathItem[]} path path in the schema
 	 * @returns {string | undefined} negative description
 	 */
@@ -144,6 +156,7 @@ const getArguments = (schema = webpackSchema) => {
 	};
 
 	/**
+	 * Gets reset description.
 	 * @param {PathItem[]} path path in the schema
 	 * @returns {string | undefined} reset description
 	 */
@@ -157,6 +170,7 @@ const getArguments = (schema = webpackSchema) => {
 	};
 
 	/**
+	 * Schema to argument config.
 	 * @param {Schema} schemaPart schema
 	 * @returns {Pick<ArgumentConfig, "type" | "values"> | undefined} partial argument config
 	 */
@@ -167,6 +181,12 @@ const getArguments = (schema = webpackSchema) => {
 				values: schemaPart.enum
 			};
 		}
+		if (schemaPart.const !== undefined) {
+			return {
+				type: "enum",
+				values: [schemaPart.const]
+			};
+		}
 		switch (schemaPart.type) {
 			case "number":
 				return {
@@ -190,6 +210,7 @@ const getArguments = (schema = webpackSchema) => {
 	};
 
 	/**
+	 * Adds the provided path to this object.
 	 * @param {PathItem[]} path path in the schema
 	 * @returns {void}
 	 */
@@ -219,6 +240,21 @@ const getArguments = (schema = webpackSchema) => {
 	};
 
 	/**
+	 * Joins the per-item segments into a JSON pointer (built only when needed).
+	 * @param {PathItem[]} path full path in schema (deepest item first)
+	 * @returns {string} JSON pointer to the deepest schema part
+	 */
+	const getOriginPath = (path) => {
+		let origin = "";
+		for (let i = path.length - 1; i >= 0; i--) {
+			const { segment } = path[i];
+			origin = segment[0] === "#" ? segment : origin + segment;
+		}
+		return origin;
+	};
+
+	/**
+	 * Adds the provided path to this object.
 	 * @param {PathItem[]} path full path in schema
 	 * @param {boolean} multiple inside of an array
 	 * @returns {number} number of arguments added
@@ -267,7 +303,11 @@ const getArguments = (schema = webpackSchema) => {
 		) {
 			if (multiple) {
 				throw new Error(
-					`Conflicting schema for ${path[0].path} with ${argConfig.type} type (array type must be before single item type)`
+					`Conflicting schema for ${path[0].path} (${getOriginPath(
+						path
+					)}) with ${
+						argConfig.type
+					} type (array type must be before single item type)`
 				);
 			}
 			return 0;
@@ -278,17 +318,25 @@ const getArguments = (schema = webpackSchema) => {
 		return 1;
 	};
 
-	// TODO support `not` and `if/then/else`
-	// TODO support `const`, but we don't use it on our schema
+	// TODO support `not`
 	/**
+	 * Returns added arguments.
 	 * @param {Schema} schemaPart the current schema
-	 * @param {string} schemaPath the current path in the schema
+	 * @param {string} schemaPath the current path in the config
 	 * @param {PathItem[]} path all previous visited schemaParts
 	 * @param {string | null} inArray if inside of an array, the path to the array
+	 * @param {string} segment the JSON pointer segment of the current schema
 	 * @returns {number} added arguments
 	 */
-	const traverse = (schemaPart, schemaPath = "", path = [], inArray = null) => {
+	const traverse = (
+		schemaPart,
+		schemaPath = "",
+		path = [],
+		inArray = null,
+		segment = "#"
+	) => {
 		while (schemaPart.$ref) {
+			segment = schemaPart.$ref;
 			schemaPart = getSchemaPart(schemaPart.$ref);
 		}
 
@@ -303,12 +351,33 @@ const getArguments = (schema = webpackSchema) => {
 		if (schemaPart.cli && schemaPart.cli.exclude) return 0;
 
 		/** @type {PathItem[]} */
-		const fullPath = [{ schema: schemaPart, path: schemaPath }, ...path];
+		const fullPath = [
+			{ schema: schemaPart, path: schemaPath, segment },
+			...path
+		];
 
 		let addedArguments = 0;
 
 		addedArguments += addFlag(fullPath, Boolean(inArray));
 
+		// Collect flags from both branches of a conditional schema.
+		const conditional = /** @type {JSONSchema7} */ (schemaPart);
+		if (conditional.if) {
+			for (const key of /** @type {const} */ (["if", "then", "else"])) {
+				const subSchema = conditional[key];
+				if (subSchema && typeof subSchema === "object") {
+					addedArguments += traverse(
+						/** @type {Schema} */
+						(subSchema),
+						schemaPath,
+						fullPath,
+						inArray,
+						`/${key}`
+					);
+				}
+			}
+		}
+
 		if (schemaPart.type === "object") {
 			if (schemaPart.properties) {
 				for (const property of Object.keys(schemaPart.properties)) {
@@ -317,7 +386,8 @@ const getArguments = (schema = webpackSchema) => {
 						(schemaPart.properties[property]),
 						schemaPath ? `${schemaPath}.${property}` : property,
 						fullPath,
-						inArray
+						inArray,
+						`/properties/${property}`
 					);
 				}
 			}
@@ -337,7 +407,8 @@ const getArguments = (schema = webpackSchema) => {
 						(item),
 						`${schemaPath}.${i}`,
 						fullPath,
-						schemaPath
+						schemaPath,
+						`/items/${i}`
 					);
 				}
 
@@ -349,7 +420,8 @@ const getArguments = (schema = webpackSchema) => {
 				(schemaPart.items),
 				`${schemaPath}[]`,
 				fullPath,
-				schemaPath
+				schemaPath,
+				"/items"
 			);
 
 			if (addedArguments > 0) {
@@ -360,10 +432,16 @@ const getArguments = (schema = webpackSchema) => {
 			return addedArguments;
 		}
 
-		const maybeOf = schemaPart.oneOf || schemaPart.anyOf || schemaPart.allOf;
+		const ofKey = schemaPart.oneOf
+			? "oneOf"
+			: schemaPart.anyOf
+				? "anyOf"
+				: schemaPart.allOf
+					? "allOf"
+					: undefined;
 
-		if (maybeOf) {
-			const items = maybeOf;
+		if (ofKey) {
+			const items = /** @type {Schema[]} */ (schemaPart[ofKey]);
 
 			for (let i = 0; i < items.length; i++) {
 				addedArguments += traverse(
@@ -371,7 +449,8 @@ const getArguments = (schema = webpackSchema) => {
 					(items[i]),
 					schemaPath,
 					fullPath,
-					inArray
+					inArray,
+					`/${ofKey}/${i}`
 				);
 			}
 
@@ -433,6 +512,15 @@ const cliAddedItems = new WeakMap();
 /** @typedef {string | number} Property */
 
 /**
+ * Whether a path segment would walk into the prototype chain.
+ * @param {string} name path segment
+ * @returns {boolean} true when the segment is unsafe to write through
+ */
+const isUnsafeKey = (name) =>
+	name === "__proto__" || name === "constructor" || name === "prototype";
+
+/**
+ * Gets object and property.
  * @param {ObjectConfiguration} config configuration
  * @param {string} schemaPath path in the config
  * @param {number | undefined} index index of value when multiple values are provided, otherwise undefined
@@ -447,6 +535,14 @@ const getObjectAndProperty = (config, schemaPath, index = 0) => {
 	for (const part of parts) {
 		const isArray = part.endsWith("[]");
 		const name = isArray ? part.slice(0, -2) : part;
+		if (isUnsafeKey(name)) {
+			return {
+				problem: {
+					type: "prototype-pollution-in-path",
+					path: parts.slice(0, i).join(".")
+				}
+			};
+		}
 		let value = current[name];
 		if (isArray) {
 			if (value === undefined) {
@@ -493,6 +589,14 @@ const getObjectAndProperty = (config, schemaPath, index = 0) => {
 		current = value;
 		i++;
 	}
+	if (isUnsafeKey(property.endsWith("[]") ? property.slice(0, -2) : property)) {
+		return {
+			problem: {
+				type: "prototype-pollution-in-path",
+				path: parts.join(".")
+			}
+		};
+	}
 	const value = current[property];
 	if (property.endsWith("[]")) {
 		const name = property.slice(0, -2);
@@ -533,6 +637,7 @@ const getObjectAndProperty = (config, schemaPath, index = 0) => {
 };
 
 /**
+ * Updates value using the provided config.
  * @param {ObjectConfiguration} config configuration
  * @param {string} schemaPath path in the config
  * @param {ParsedValue} value parsed value
@@ -552,6 +657,7 @@ const setValue = (config, schemaPath, value, index) => {
 };
 
 /**
+ * Process argument config.
  * @param {ArgumentConfig} argConfig processing instructions
  * @param {ObjectConfiguration} config configuration
  * @param {Value} value the value
@@ -579,6 +685,7 @@ const processArgumentConfig = (argConfig, config, value, index) => {
 };
 
 /**
+ * Gets expected value.
  * @param {ArgumentConfig} argConfig processing instructions
  * @returns {string | undefined} expected message
  */
@@ -606,6 +713,7 @@ const getExpectedValue = (argConfig) => {
 const DECIMAL_NUMBER_REGEXP = /^[+-]?(?:\d+\.?\d*|\.\d+)(?:e[+-]?\d+)?$/i;
 
 /**
+ * Parses value for argument config.
  * @param {ArgumentConfig} argConfig processing instructions
  * @param {Value} value the value
  * @returns {ParsedValue | undefined} parsed value
@@ -665,6 +773,7 @@ const parseValueForArgumentConfig = (argConfig, value) => {
 /** @typedef {Record<string, Value[]>} Values */
 
 /**
+ * Processes the provided arg.
  * @param {Flags} args object of arguments
  * @param {ObjectConfiguration} config configuration
  * @param {Values} values object with values
@@ -684,6 +793,7 @@ const processArguments = (args, config, values) => {
 			continue;
 		}
 		/**
+		 * Processes the provided value.
 		 * @param {Value} value value
 		 * @param {number | undefined} i index
 		 */
@@ -718,21 +828,26 @@ const processArguments = (args, config, values) => {
 };
 
 /**
+ * Checks whether this object is color supported.
  * @returns {boolean} true when colors supported, otherwise false
  */
 const isColorSupported = () => {
 	const { env = {}, argv = [], platform = "" } = process;
 
-	const isDisabled = "NO_COLOR" in env || argv.includes("--no-color");
-	const isForced = "FORCE_COLOR" in env || argv.includes("--color");
+	// Read values instead of using `in`: Deno's and Bun's `process.env` honor
+	// property access but not the `in`/`has` trap, so `"X" in env` is unreliable.
+	const isDisabled = env.NO_COLOR !== undefined || argv.includes("--no-color");
+	const isForced = env.FORCE_COLOR !== undefined || argv.includes("--color");
 	const isWindows = platform === "win32";
 	const isDumbTerminal = env.TERM === "dumb";
 
 	const isCompatibleTerminal = tty.isatty(1) && env.TERM && !isDumbTerminal;
 
 	const isCI =
-		"CI" in env &&
-		("GITHUB_ACTIONS" in env || "GITLAB_CI" in env || "CIRCLECI" in env);
+		env.CI !== undefined &&
+		(env.GITHUB_ACTIONS !== undefined ||
+			env.GITLAB_CI !== undefined ||
+			env.CIRCLECI !== undefined);
 
 	return (
 		!isDisabled &&
@@ -741,6 +856,7 @@ const isColorSupported = () => {
 };
 
 /**
+ * Returns result.
  * @param {number} index index
  * @param {string} string string
  * @param {string} close close
@@ -761,6 +877,7 @@ const replaceClose = (
 ) => head + (next < 0 ? tail : replaceClose(next, tail, close, replace));
 
 /**
+ * Returns result.
  * @param {number} index index to replace
  * @param {string} string string
  * @param {string} open open string
@@ -776,6 +893,7 @@ const clearBleed = (index, string, open, close, replace) =>
 /** @typedef {(value: EXPECTED_ANY) => string} PrintFunction */
 
 /**
+ * Returns function to create color.
  * @param {string} open open string
  * @param {string} close close string
  * @param {string=} replace extra replace
@@ -790,6 +908,7 @@ const filterEmpty =
 			: "";
 
 /**
+ * Returns result.
  * @param {number} open open code
  * @param {number} close close code
  * @param {string=} replace extra replace
@@ -799,15 +918,18 @@ const init = (open, close, replace) =>
 	filterEmpty(`\u001B[${open}m`, `\u001B[${close}m`, replace);
 
 /**
+ * Defines the colors type used by this module.
  * @typedef {{ reset: PrintFunction, bold: PrintFunction, dim: PrintFunction, italic: PrintFunction, underline: PrintFunction, inverse: PrintFunction, hidden: PrintFunction, strikethrough: PrintFunction, black: PrintFunction, red: PrintFunction, green: PrintFunction, yellow: PrintFunction, blue: PrintFunction, magenta: PrintFunction, cyan: PrintFunction, white: PrintFunction, gray: PrintFunction, bgBlack: PrintFunction, bgRed: PrintFunction, bgGreen: PrintFunction, bgYellow: PrintFunction, bgBlue: PrintFunction, bgMagenta: PrintFunction, bgCyan: PrintFunction, bgWhite: PrintFunction, blackBright: PrintFunction, redBright: PrintFunction, greenBright: PrintFunction, yellowBright: PrintFunction, blueBright: PrintFunction, magentaBright: PrintFunction, cyanBright: PrintFunction, whiteBright: PrintFunction, bgBlackBright: PrintFunction, bgRedBright: PrintFunction, bgGreenBright: PrintFunction, bgYellowBright: PrintFunction, bgBlueBright: PrintFunction, bgMagentaBright: PrintFunction, bgCyanBright: PrintFunction, bgWhiteBright: PrintFunction }} Colors
  */
 
 /**
+ * Defines the colors options type used by this module.
  * @typedef {object} ColorsOptions
  * @property {boolean=} useColor force use colors
  */
 
 /**
+ * Creates a colors from the provided colors option.
  * @param {ColorsOptions=} options options
  * @returns {Colors} colors
  */

package/lib/config/browserslistTargetHandler.js

@@ -16,6 +16,7 @@ const browserslist = require("browserslist");
 const inputRx = /^(?:((?:[A-Z]:)?[/\\].*?))?(?::(.+?))?$/i;
 
 /**
+ * Returns selected browsers.
  * @param {string | null | undefined} input input string
  * @param {string} context the context directory
  * @returns {string[] | undefined} selected browsers
@@ -58,6 +59,7 @@ const load = (input, context) => {
 };
 
 /**
+ * Returns target properties.
  * @param {string[]} browsers supported browsers list
  * @returns {EcmaTargetProperties & PlatformTargetProperties & ApiTargetProperties} target properties
  */
@@ -118,6 +120,44 @@ const resolve = (browsers) => {
 			kaios: [2, 5],
 			node: [6, 0]
 		}),
+		let: rawChecker({
+			chrome: 49,
+			and_chr: 49,
+			edge: 12,
+			firefox: 44,
+			and_ff: 44,
+			// ie: Not supported
+			opera: 36,
+			op_mob: 36,
+			safari: [10, 0],
+			ios_saf: [10, 0],
+			samsung: [5, 0],
+			android: 49,
+			and_qq: [10, 4],
+			baidu: [13, 18],
+			and_uc: [12, 12],
+			kaios: [2, 5],
+			node: [6, 0]
+		}),
+		logicalAssignment: rawChecker({
+			chrome: 85,
+			and_chr: 85,
+			edge: 85,
+			firefox: 79,
+			and_ff: 79,
+			// ie: Not supported,
+			opera: 71,
+			op_mob: 60,
+			safari: 14,
+			ios_saf: 14,
+			samsung: [14, 0],
+			android: 85,
+			and_qq: [14, 9],
+			baidu: [13, 52],
+			and_uc: [15, 5],
+			kaios: [3, 0],
+			node: [15, 0]
+		}),
 		methodShorthand: rawChecker({
 			chrome: 47,
 			and_chr: 47,
@@ -315,6 +355,62 @@ const resolve = (browsers) => {
 			kaios: [3, 0],
 			node: 14
 		}),
+		symbol: rawChecker({
+			chrome: 38,
+			and_chr: 38,
+			edge: 12,
+			firefox: 36,
+			and_ff: 36,
+			// ie: Not supported,
+			opera: 25,
+			op_mob: 25,
+			safari: 9,
+			ios_saf: 9,
+			samsung: [3, 0],
+			android: 38,
+			and_qq: [10, 4],
+			and_uc: [12, 12],
+			kaios: [2, 5],
+			node: [0, 12]
+		}),
+		hasOwn: rawChecker({
+			chrome: 93,
+			and_chr: 93,
+			edge: 93,
+			firefox: 92,
+			and_ff: 92,
+			// ie: Not supported,
+			opera: 79,
+			op_mob: 66,
+			safari: [15, 4],
+			ios_saf: [15, 4],
+			samsung: 17,
+			android: 93,
+			// and_qq: Not supported
+			// baidu: Not supported
+			// and_uc: Not supported
+			// kaios: Not supported
+			node: [16, 9]
+		}),
+		spread: rawChecker({
+			chrome: 60,
+			and_chr: 60,
+			edge: 79,
+			firefox: 55,
+			and_ff: 55,
+			// ie: Not supported,
+			opera: 47,
+			op_mob: 44,
+			safari: [11, 1],
+			ios_saf: [11, 3],
+			samsung: [8, 2],
+			android: 60,
+			and_qq: [13, 1],
+			// baidu: Not supported
+			and_uc: [15, 5],
+			kaios: [3, 0],
+			node: [8, 3]
+		}),
 		templateLiteral: rawChecker({
 			chrome: 41,
 			and_chr: 41,
@@ -353,6 +449,25 @@ const resolve = (browsers) => {
 			kaios: 3,
 			node: [7, 6]
 		}),
+		generator: rawChecker({
+			chrome: 39,
+			and_chr: 39,
+			edge: 13,
+			firefox: 26,
+			and_ff: 26,
+			// ie: Not supported,
+			opera: 26,
+			op_mob: 26,
+			safari: 10,
+			ios_saf: 10,
+			samsung: [3, 4],
+			android: 39,
+			and_qq: [10, 4],
+			baidu: [7, 12],
+			and_uc: [12, 12],
+			kaios: [2, 5],
+			node: 4
+		}),
 		/* eslint-enable camelcase */
 		browser: browserProperty,
 		electron: false,
@@ -362,6 +477,27 @@ const resolve = (browsers) => {
 		webworker: false,
 
 		document: browserProperty,
+		modulePreload:
+			browserProperty &&
+			/* eslint-disable camelcase */
+			rawChecker({
+				chrome: 66,
+				and_chr: 66,
+				edge: 79,
+				firefox: 115,
+				and_ff: 115,
+				opera: 53,
+				op_mob: 47,
+				safari: 17,
+				ios_saf: 17,
+				samsung: [9, 0],
+				android: 66,
+				and_qq: [13, 1],
+				baidu: [13, 18],
+				and_uc: [15, 5],
+				kaios: [3, 1]
+			}),
+		/* eslint-enable camelcase */
 		fetchWasm: browserProperty,
 		global: nodeProperty,
 		importScripts: false,
@@ -378,6 +514,11 @@ const resolve = (browsers) => {
 			rawChecker({
 				node: [22, 16]
 			}),
+		nodeBuiltinModuleGetter:
+			nodeProperty &&
+			rawChecker({
+				node: [22, 3]
+			}),
 		require: nodeProperty
 	};
 };