@naturalcycles/nodejs-lib 15.106.0 → 15.106.2

package/dist/validation/ajv/jSchema.d.ts

@@ -78,7 +78,7 @@ export declare const j: {
      * Use `anyOf` when schemas may overlap (e.g., AccountId | PartnerId with same format).
      * Use `oneOf` when schemas are mutually exclusive.
      */
-    oneOf<B extends readonly JSchema<any, boolean>[], OUT = BuilderOutUnion<B>>(items: [...B]): JBuilder<OUT, false>;
+    oneOf<B extends readonly JSchema<any, boolean>[]>(items: [...B]): JBuilder<BuilderOutUnion<B>, false>;
     /**
      * Use only with primitive values, otherwise this function will throw to avoid bugs.
      * To validate objects, use `anyOfBy` or `anyOfThese`.
@@ -90,7 +90,7 @@ export declare const j: {
      * Use `anyOf` when schemas may overlap (e.g., AccountId | PartnerId with same format).
      * Use `oneOf` when schemas are mutually exclusive.
      */
-    anyOf<B extends readonly JSchema<any, boolean>[], OUT = BuilderOutUnion<B>>(items: [...B]): JBuilder<OUT, false>;
+    anyOf<B extends readonly JSchema<any, boolean>[]>(items: [...B]): JBuilder<BuilderOutUnion<B>, false>;
     /**
      * Pick validation schema for an object based on the value of a specific property.
      *
@@ -103,7 +103,7 @@ export declare const j: {
      * const schema = j.anyOfBy('success', schemaMap)
      * ```
      */
-    anyOfBy<D extends Record<PropertyKey, JSchema<any, any>>, OUT = AnyOfByOut<D>>(propertyName: string, schemaDictionary: D): JBuilder<OUT, false>;
+    anyOfBy<D extends Record<PropertyKey, JSchema<any, any>>>(propertyName: string, schemaDictionary: D): JBuilder<AnyOfByOut<D>, false>;
     /**
      * Custom version of `anyOf` which - in contrast to the original function - does not mutate the input.
      * This comes with a performance penalty, so do not use it where performance matters.
@@ -112,7 +112,7 @@ export declare const j: {
      * const schema = j.anyOfThese([successSchema, errorSchema])
      * ```
      */
-    anyOfThese<B extends readonly JSchema<any, boolean>[], OUT = BuilderOutUnion<B>>(items: [...B]): JBuilder<OUT, false>;
+    anyOfThese<B extends readonly JSchema<any, boolean>[]>(items: [...B]): JBuilder<BuilderOutUnion<B>, false>;
     and(): {
         silentBob: () => never;
     };

package/dist/validation/ajv/jsonSchemaBuilder.util.js

@@ -47,6 +47,8 @@ export function mergeJsonSchemaObjects(schema1, schema2) {
     const s1 = schema1;
     const s2 = schema2;
     // Merge `properties`
+    // Not vulnerable to prototype pollution: writes to s1.properties (a nested object),
+    // where __proto__ assignment only changes that object's prototype, not Object.prototype.
     Object.entries(s2.properties).forEach(([k, v]) => {
         s1.properties[k] = v;
     });

package/dist/validation/timezones.js

@@ -600,6 +600,7 @@ const TIMEZONES_FROM_WIKI = [
     'WET',
     'Zulu',
 ];
+// oxlint-disable-next-line no-restricted-globals
 const TIMEZONES_FROM_JS = Intl.supportedValuesOf('timeZone');
 /**
  * A complicated merge of timezones from the underlying Javascript engine

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@naturalcycles/nodejs-lib",
   "type": "module",
-  "version": "15.106.0",
+  "version": "15.106.2",
   "dependencies": {
     "@naturalcycles/js-lib": "^15",
     "@standard-schema/spec": "^1",

package/src/validation/ajv/jSchema.ts

@@ -219,16 +219,16 @@ export const j = {
    * Use `anyOf` when schemas may overlap (e.g., AccountId | PartnerId with same format).
    * Use `oneOf` when schemas are mutually exclusive.
    */
-  oneOf<B extends readonly JSchema<any, boolean>[], OUT = BuilderOutUnion<B>>(
+  oneOf<B extends readonly JSchema<any, boolean>[]>(
     items: [...B],
-  ): JBuilder<OUT, false> {
+  ): JBuilder<BuilderOutUnion<B>, false> {
     const schemas = items.map(b => b.build())
     _assert(
       schemas.every(hasNoObjectSchemas),
       'Do not use `oneOf` validation with non-primitive types!',
     )
 
-    return new JBuilder<OUT, false>({
+    return new JBuilder<BuilderOutUnion<B>, false>({
       oneOf: schemas,
     })
   },
@@ -244,16 +244,16 @@ export const j = {
    * Use `anyOf` when schemas may overlap (e.g., AccountId | PartnerId with same format).
    * Use `oneOf` when schemas are mutually exclusive.
    */
-  anyOf<B extends readonly JSchema<any, boolean>[], OUT = BuilderOutUnion<B>>(
+  anyOf<B extends readonly JSchema<any, boolean>[]>(
     items: [...B],
-  ): JBuilder<OUT, false> {
+  ): JBuilder<BuilderOutUnion<B>, false> {
     const schemas = items.map(b => b.build())
     _assert(
       schemas.every(hasNoObjectSchemas),
       'Do not use `anyOf` validation with non-primitive types!',
     )
 
-    return new JBuilder<OUT, false>({
+    return new JBuilder<BuilderOutUnion<B>, false>({
       anyOf: schemas,
     })
   },
@@ -270,16 +270,16 @@ export const j = {
    * const schema = j.anyOfBy('success', schemaMap)
    * ```
    */
-  anyOfBy<D extends Record<PropertyKey, JSchema<any, any>>, OUT = AnyOfByOut<D>>(
+  anyOfBy<D extends Record<PropertyKey, JSchema<any, any>>>(
     propertyName: string,
     schemaDictionary: D,
-  ): JBuilder<OUT, false> {
+  ): JBuilder<AnyOfByOut<D>, false> {
     const builtSchemaDictionary: Record<string, JsonSchema> = {}
     for (const [key, schema] of Object.entries(schemaDictionary)) {
       builtSchemaDictionary[key] = schema.build()
     }
 
-    return new JBuilder<OUT, false>({
+    return new JBuilder<AnyOfByOut<D>, false>({
       type: 'object',
       hasIsOfTypeCheck: true,
       anyOfBy: {
@@ -297,10 +297,10 @@ export const j = {
    * const schema = j.anyOfThese([successSchema, errorSchema])
    * ```
    */
-  anyOfThese<B extends readonly JSchema<any, boolean>[], OUT = BuilderOutUnion<B>>(
+  anyOfThese<B extends readonly JSchema<any, boolean>[]>(
     items: [...B],
-  ): JBuilder<OUT, false> {
-    return new JBuilder<OUT, false>({
+  ): JBuilder<BuilderOutUnion<B>, false> {
+    return new JBuilder<BuilderOutUnion<B>, false>({
       anyOfThese: items.map(b => b.build()),
     })
   },

package/src/validation/ajv/jsonSchemaBuilder.util.ts

@@ -55,6 +55,8 @@ export function mergeJsonSchemaObjects<T1 extends AnyObject, T2 extends AnyObjec
   const s2 = schema2 as any
 
   // Merge `properties`
+  // Not vulnerable to prototype pollution: writes to s1.properties (a nested object),
+  // where __proto__ assignment only changes that object's prototype, not Object.prototype.
   Object.entries(s2.properties).forEach(([k, v]) => {
     s1.properties[k] = v
   })

package/src/validation/timezones.ts

@@ -603,6 +603,7 @@ const TIMEZONES_FROM_WIKI = [
   'Zulu',
 ] as IANATimezone[]
 
+// oxlint-disable-next-line no-restricted-globals
 const TIMEZONES_FROM_JS = Intl.supportedValuesOf('timeZone') as IANATimezone[]
 
 /**