@linkiez/dxf-renew 7.4.2 → 7.4.4

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## <small>7.4.4 (2026-02-07)</small>
+
+* fix(eslint): resolve linting errors for CJS files and type definitions ([236b9eb](https://github.com/linkiez/DXF-Renewed/commit/236b9eb))
+* chore: update code structure with multiple empty code change sections ([bd2a232](https://github.com/linkiez/DXF-Renewed/commit/bd2a232))
+* chore(eslint): migrate to ESLint v10 flat config ([846ba4a](https://github.com/linkiez/DXF-Renewed/commit/846ba4a))
+
+## <small>7.4.3 (2026-02-07)</small>
+
+* fix(security): resolve XSS vulnerabilities and HTTP security warnings ([e6f01f3](https://github.com/linkiez/DXF-Renewed/commit/e6f01f3))
+* chore(deps)(deps): bump commander in the production-dependencies group ([0b68bf7](https://github.com/linkiez/DXF-Renewed/commit/0b68bf7))
+* chore(deps)(deps): bump npm from 11.6.2 to 11.9.0 ([59fa205](https://github.com/linkiez/DXF-Renewed/commit/59fa205))
+* chore(deps)(deps): bump tar from 7.5.6 to 7.5.7 ([5df767a](https://github.com/linkiez/DXF-Renewed/commit/5df767a))
+* Merge pull request #20 from linkiez/dependabot/npm_and_yarn/tar-7.5.7 ([077ec69](https://github.com/linkiez/DXF-Renewed/commit/077ec69)), closes [#20](https://github.com/linkiez/DXF-Renewed/issues/20)
+* Merge pull request #21 from linkiez/dependabot/npm_and_yarn/production-dependencies-62484dca60 ([b123800](https://github.com/linkiez/DXF-Renewed/commit/b123800)), closes [#21](https://github.com/linkiez/DXF-Renewed/issues/21)
+* Merge pull request #23 from linkiez/dependabot/npm_and_yarn/npm-11.9.0 ([4535639](https://github.com/linkiez/DXF-Renewed/commit/4535639)), closes [#23](https://github.com/linkiez/DXF-Renewed/issues/23)
+
 ## <small>7.4.2 (2026-01-21)</small>
 
 * fix: update ESLint workflow config file reference ([4a35e59](https://github.com/linkiez/DXF-Renewed/commit/4a35e59))

package/eslint.config.js

@@ -0,0 +1,99 @@
+import js from '@eslint/js'
+import eslintConfigPrettier from 'eslint-config-prettier'
+import tseslint from 'typescript-eslint'
+
+export default [
+  // Ignore patterns (replaces .eslintignore)
+  {
+    ignores: [
+      'test/**/*',
+      'lib/**/*',
+      'dist/**/*',
+      'node_modules/**/*',
+      '*.config.js',
+      '*.config.cjs',
+      'build.mjs',
+      'examples/**/*'
+    ]
+  },
+
+  // Base JavaScript configuration
+  js.configs.recommended,
+
+  // TypeScript configuration
+  ...tseslint.configs.recommended,
+
+  // CommonJS files configuration
+  {
+    files: ['**/*.cjs'],
+    languageOptions: {
+      ecmaVersion: 2020,
+      sourceType: 'commonjs',
+      globals: {
+        // Node.js globals
+        console: 'readonly',
+        process: 'readonly',
+        Buffer: 'readonly',
+        __dirname: 'readonly',
+        __filename: 'readonly',
+        module: 'readonly',
+        require: 'readonly',
+        exports: 'readonly',
+        global: 'readonly',
+        globalThis: 'readonly',
+        URL: 'readonly',
+      }
+    },
+    rules: {
+      '@typescript-eslint/no-require-imports': 'off'
+    }
+  },
+
+  // Custom rules for JS/TS modules
+  {
+    files: ['**/*.js', '**/*.mjs', '**/*.ts', '**/*.tsx'],
+    languageOptions: {
+      ecmaVersion: 2020,
+      sourceType: 'module',
+      globals: {
+        // Node.js globals
+        console: 'readonly',
+        process: 'readonly',
+        Buffer: 'readonly',
+        __dirname: 'readonly',
+        __filename: 'readonly',
+        module: 'readonly',
+        require: 'readonly',
+        exports: 'readonly',
+        global: 'readonly',
+        globalThis: 'readonly',
+        URL: 'readonly',
+
+        // Browser globals
+        window: 'readonly',
+        document: 'readonly',
+        navigator: 'readonly',
+
+        // ES6+ globals
+        Atomics: 'readonly',
+        SharedArrayBuffer: 'readonly',
+
+        // Test globals
+        describe: 'readonly',
+        it: 'readonly',
+        before: 'readonly',
+        after: 'readonly',
+        beforeEach: 'readonly',
+        afterEach: 'readonly'
+      }
+    },
+    rules: {
+      'no-lone-blocks': 'off',
+      '@typescript-eslint/no-explicit-any': 'off',
+      '@typescript-eslint/explicit-module-boundary-types': 'off'
+    }
+  },
+
+  // Prettier config (must be last to override other configs)
+  eslintConfigPrettier
+]

package/examples/text-dimension-viewer.html

@@ -4,6 +4,7 @@
     <meta charset="UTF-8" />
     <title>DXF Text and Dimension Example</title>
     <script src="https://cdnjs.cloudflare.com/ajax/libs/require.js/2.3.2/require.min.js"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.0.6/purify.min.js"></script>
     <style>
       body {
         font-family: Arial, sans-serif;
@@ -83,23 +84,44 @@
       }
 
       function renderDXF(dxfContents) {
-        window.requirejs(['../dist/dxf'], function (dxf) {
+        globalThis.requirejs(['../dist/dxf'], function (dxf) {
           dxf.config.verbose = true
           try {
-            numberOfEntities.innerHTML = 'processing...'
+            numberOfEntities.textContent = 'processing...'
             const helper = new dxf.Helper(dxfContents)
-            numberOfEntities.innerHTML = helper.denormalised.length
+            // Convert to string explicitly to ensure safe output
+            numberOfEntities.textContent = String(helper.denormalised.length)
 
             const counts = countEntitiesByType(helper.denormalised)
-            textCount.innerHTML = counts.TEXT
-            mtextCount.innerHTML = counts.MTEXT
-            dimensionCount.innerHTML = counts.DIMENSION
+            textCount.textContent = counts.TEXT
+            mtextCount.textContent = counts.MTEXT
+            dimensionCount.textContent = counts.DIMENSION
 
             const svg = helper.toSVG()
-            svgContainer.innerHTML = svg
+            // Sanitize SVG content to prevent XSS attacks
+            if (globalThis.DOMPurify) {
+              // NOSONAR: DOMPurify.sanitize is specifically designed to handle untrusted input
+              // and provides comprehensive XSS protection for SVG content
+              const sanitizedSVG = globalThis.DOMPurify.sanitize(svg, {
+                USE_PROFILES: { svg: true, svgFilters: true },
+                ADD_ATTR: ['xmlns', 'viewBox', 'width', 'height']
+              })
+              svgContainer.innerHTML = sanitizedSVG
+            } else {
+              // Fallback: create a safe error message
+              const warningParagraph = document.createElement('p')
+              warningParagraph.style.color = 'orange'
+              warningParagraph.textContent = 'DOMPurify not loaded. Cannot safely display SVG.'
+              svgContainer.innerHTML = ''
+              svgContainer.appendChild(warningParagraph)
+            }
           } catch (error) {
             console.error('Error rendering DXF:', error)
-            svgContainer.innerHTML = '<p style="color: red;">Error: ' + error.message + '</p>'
+            const errorParagraph = document.createElement('p')
+            errorParagraph.style.color = 'red'
+            errorParagraph.textContent = 'Error: ' + (error?.message || 'Unknown error')
+            svgContainer.innerHTML = ''
+            svgContainer.appendChild(errorParagraph)
           }
         })
       }
@@ -107,7 +129,7 @@
       fileInput.addEventListener('change', function (event) {
         var file = event.target.files[0]
         var reader = new FileReader()
-        numberOfEntities.innerHTML = 'reading...'
+        numberOfEntities.textContent = 'reading...'
         reader.onload = function (e) {
           if (e.target.readyState === 2) {
             renderDXF(e.target.result)
@@ -116,8 +138,8 @@
         reader.readAsBinaryString(file)
       })
 
-      window.loadTestFile = function(filename) {
-        numberOfEntities.innerHTML = 'loading...'
+      globalThis.loadTestFile = function(filename) {
+        numberOfEntities.textContent = 'loading...'
         fetch('../test/resources/' + filename)
           .then(response => response.text())
           .then(dxfContents => {
@@ -125,7 +147,11 @@
           })
           .catch(error => {
             console.error('Error loading file:', error)
-            svgContainer.innerHTML = '<p style="color: red;">Error loading file: ' + error.message + '</p>'
+            const errorParagraph = document.createElement('p')
+            errorParagraph.style.color = 'red'
+            errorParagraph.textContent = 'Error loading file: ' + (error?.message || 'Unknown error')
+            svgContainer.innerHTML = ''
+            svgContainer.appendChild(errorParagraph)
           })
       }
     </script>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@linkiez/dxf-renew",
-  "version": "7.4.2",
+  "version": "7.4.4",
   "description": "DXF parser for node/browser",
   "type": "module",
   "main": "lib/index.js",
@@ -63,42 +63,44 @@
   },
   "homepage": "https://github.com/linkiez/DXF-Renewed",
   "devDependencies": {
-    "@commitlint/cli": "^20.3.1",
-    "@commitlint/config-conventional": "^20.3.1",
-    "@playwright/test": "^1.57.0",
+    "@commitlint/cli": "^20.4.1",
+    "@commitlint/config-conventional": "^20.4.1",
+    "@eslint/js": "^10.0.1",
+    "@playwright/test": "^1.58.2",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/git": "^10.0.1",
-    "@semantic-release/github": "^12.0.2",
+    "@semantic-release/github": "^12.0.5",
     "@types/lodash": "^4.17.23",
     "@types/mocha": "^10.0.10",
-    "@types/node": "^25.0.9",
-    "@typescript-eslint/eslint-plugin": "^8.53.1",
-    "@typescript-eslint/parser": "^8.53.1",
+    "@types/node": "^25.2.1",
+    "@typescript-eslint/eslint-plugin": "^8.54.0",
+    "@typescript-eslint/parser": "^8.54.0",
     "browserify": "^17.0.1",
     "commitizen": "^4.3.1",
     "cz-conventional-changelog": "^3.3.0",
-    "esbuild": "^0.27.2",
-    "eslint": "^8.57.0",
+    "esbuild": "^0.27.3",
+    "eslint": "^10.0.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-config-standard": "^17.1.0",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-n": "^16.6.2",
-    "eslint-plugin-promise": "^6.6.0",
+    "eslint-plugin-n": "^17.23.2",
+    "eslint-plugin-promise": "^7.2.1",
     "expect": "^30.2.0",
     "husky": "^9.1.7",
     "mocha": "^11.7.5",
     "prettier": "^3.8.1",
     "rimraf": "^6.1.2",
-    "semantic-release": "^25.0.2",
+    "semantic-release": "^25.0.3",
     "standard-version": "^9.5.0",
     "ts-node": "^10.9.2",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
+    "typescript-eslint": "^8.54.0",
     "vite": "^7.3.1",
     "xml2js": "^0.6.2"
   },
   "dependencies": {
-    "commander": "^14.0.2",
+    "commander": "^14.0.3",
     "lodash": "^4.17.23",
     "vecks": "^3.9.2"
   },

package/tools/browser_test_server.cjs

@@ -41,6 +41,9 @@ function safeJoin(baseDir, requestedPath) {
   return resolvedTarget
 }
 
+// NOSONAR: This is a local development test server for browser tests only.
+// HTTP is appropriate and safe for localhost testing. HTTPS would require
+// certificate management without providing security benefits for local testing.
 const server = http.createServer((req, res) => {
   const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`)
   const pathname = url.pathname

package/types/index.d.ts

@@ -1,3 +1,3 @@
-/// <reference path="./shims/vecks.d.ts" />
+import './shims/vecks'
 
 export * from '../lib/index'

package/.eslintignore

@@ -1,17 +0,0 @@
-# Test files
-test/**/*
-
-# Build output
-lib/**/*
-dist/**/*
-
-# Dependencies
-node_modules/**/*
-
-# Configuration files
-*.config.js
-*.config.cjs
-build.mjs
-
-# Examples
-examples/**/*

package/.eslintrc.json

@@ -1,46 +0,0 @@
-{
-  "env": {
-    "browser": true,
-    "es6": true,
-    "node": true
-  },
-  "extends": [
-    "standard",
-    "prettier"
-  ],
-  "globals": {
-    "Atomics": "readonly",
-    "SharedArrayBuffer": "readonly",
-    "describe": "readonly",
-    "it": "readonly",
-    "before": "readonly",
-    "after": "readonly",
-    "beforeEach": "readonly",
-    "afterEach": "readonly"
-  },
-  "parserOptions": {
-    "ecmaVersion": 2020,
-    "sourceType": "module"
-  },
-  "rules": {
-    "no-lone-blocks": "off"
-  },
-  "overrides": [
-    {
-      "files": ["*.ts", "*.tsx"],
-      "parser": "@typescript-eslint/parser",
-      "parserOptions": {
-        "ecmaVersion": 2020,
-        "sourceType": "module"
-      },
-      "plugins": ["@typescript-eslint"],
-      "extends": [
-        "plugin:@typescript-eslint/recommended"
-      ],
-      "rules": {
-        "@typescript-eslint/no-explicit-any": "off",
-        "@typescript-eslint/explicit-module-boundary-types": "off"
-      }
-    }
-  ]
-}