@hyperfrontend/versioning 0.1.0 → 0.3.0

package/changelog/index.esm.js

@@ -70,6 +70,8 @@ function createChangelogItem(description, options) {
         commits: options?.commits ?? [],
         references: options?.references ?? [],
         breaking: options?.breaking ?? false,
+        source: options?.source,
+        indirect: options?.indirect,
     };
 }
 /**
@@ -2084,6 +2086,25 @@ function parseVersionFromHeading(heading) {
     if (trimmed[pos] === ']') {
         pos++;
     }
+    // Handle markdown link format [version](url) - jscutlery/semver style
+    // This extracts the compare URL from patterns like [0.0.4](https://github.com/.../compare/...)
+    if (trimmed[pos] === '(') {
+        const urlStart = pos + 1;
+        let depth = 1;
+        pos++;
+        // Find matching closing parenthesis (handles nested parens in URLs)
+        while (pos < trimmed.length && depth > 0) {
+            if (trimmed[pos] === '(')
+                depth++;
+            else if (trimmed[pos] === ')')
+                depth--;
+            pos++;
+        }
+        // Extract URL if we found the closing paren
+        if (depth === 0) {
+            compareUrl = trimmed.slice(urlStart, pos - 1);
+        }
+    }
     // Skip whitespace and separator
     while (pos < trimmed.length && (trimmed[pos] === ' ' || trimmed[pos] === '-' || trimmed[pos] === '–')) {
         pos++;
@@ -2100,8 +2121,8 @@ function parseVersionFromHeading(heading) {
     while (pos < trimmed.length && trimmed[pos] === ' ') {
         pos++;
     }
-    // Check for link at end: [compare](url)
-    if (pos < trimmed.length) {
+    // Check for link at end: [compare](url) - only if no URL was already extracted
+    if (pos < trimmed.length && !compareUrl) {
         const linkMatch = extractLink(trimmed.slice(pos));
         if (linkMatch?.url) {
             compareUrl = linkMatch.url;
@@ -2819,11 +2840,22 @@ function isWhitespace$1(char) {
 }
 
 /**
- * Changelog Parser
+ * Validates that a URL is actually a GitHub URL by parsing it properly.
+ * This prevents SSRF attacks where 'github.com' could appear in path/query.
  *
- * Parses a changelog markdown string into a structured Changelog object.
- * Uses a state machine tokenizer for ReDoS-safe parsing.
+ * @param url - The URL string to validate
+ * @returns True if the URL host is github.com or a subdomain
  */
+function isGitHubUrl(url) {
+    try {
+        const parsed = createURL(url);
+        // Check that the host is exactly github.com or ends with .github.com
+        return parsed.host === 'github.com' || parsed.host.endsWith('.github.com');
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Parses a changelog markdown string into a Changelog object.
  *
@@ -2891,7 +2923,7 @@ function parseHeader(state) {
                 description.push(`[${token.value}](${nextToken.value})`);
                 links.push({ label: token.value, url: nextToken.value });
                 // Try to detect repository URL
-                if (!state.repositoryUrl && nextToken.value.includes('github.com')) {
+                if (!state.repositoryUrl && isGitHubUrl(nextToken.value)) {
                     state.repositoryUrl = extractRepoUrl(nextToken.value);
                 }
                 advance(state); // skip link-text