@node-core/utils 7.1.0 → 7.2.1

package/node_modules/cli-truncate/node_modules/string-width/index.js

@@ -5,22 +5,49 @@ import {eastAsianWidth} from 'get-east-asian-width';
 Logic:
 - Segment graphemes to match how terminals render clusters.
 - Width rules:
-	1. Skip non-printing clusters (Default_Ignorable, Control, pure Mark, lone Surrogates). Tabs are ignored by design.
+	1. Skip non-printing clusters (Default_Ignorable, Control, pure nonspacing/enclosing Mark, lone Surrogates). Tabs are ignored by design.
 	2. RGI emoji clusters (\p{RGI_Emoji}) are double-width.
-	3. Otherwise use East Asian Width of the cluster’s first visible code point, and add widths for trailing Halfwidth/Fullwidth Forms within the same cluster (e.g., dakuten/handakuten/prolonged sound mark).
+	3. Minimally-qualified/unqualified emoji clusters (ZWJ sequences with 2+ Extended_Pictographic, or keycap sequences) are double-width.
+	4. Hangul jamo collapse each standard modern Hangul L+V or L+V+T syllable piece to width 2.
+	   Unmatched repeated leading/vowel/trailing jamo stay additive because that matches how the terminals we target render them.
+	5. Otherwise use East Asian Width of the cluster's first visible code point, and add widths for trailing spacing marks and Halfwidth/Fullwidth Forms within the same cluster (e.g., dakuten/handakuten/prolonged sound mark).
 */
 
 const segmenter = new Intl.Segmenter();
 
 // Whole-cluster zero-width
-const zeroWidthClusterRegex = /^(?:\p{Default_Ignorable_Code_Point}|\p{Control}|\p{Mark}|\p{Surrogate})+$/v;
+const zeroWidthClusterRegex = /^(?:\p{Default_Ignorable_Code_Point}|\p{Control}|\p{Format}|\p{Nonspacing_Mark}|\p{Enclosing_Mark}|\p{Surrogate})+$/v;
 
 // Pick the base scalar if the cluster starts with Prepend/Format/Marks
-const leadingNonPrintingRegex = /^[\p{Default_Ignorable_Code_Point}\p{Control}\p{Format}\p{Mark}\p{Surrogate}]+/v;
+const leadingNonPrintingRegex = /^[\p{Default_Ignorable_Code_Point}\p{Control}\p{Format}\p{Nonspacing_Mark}\p{Enclosing_Mark}\p{Surrogate}]+/v;
+const spacingMarkRegex = /\p{Spacing_Mark}/v;
 
 // RGI emoji sequences
 const rgiEmojiRegex = /^\p{RGI_Emoji}$/v;
 
+// Detect minimally-qualified/unqualified emoji sequences (missing VS16 but still render as double-width)
+const unqualifiedKeycapRegex = /^[\d#*]\u20E3$/;
+const extendedPictographicRegex = /\p{Extended_Pictographic}/gu;
+
+function isDoubleWidthNonRgiEmojiSequence(segment) {
+	// Real emoji clusters are < 30 chars; guard against pathological input
+	if (segment.length > 50) {
+		return false;
+	}
+
+	if (unqualifiedKeycapRegex.test(segment)) {
+		return true;
+	}
+
+	// ZWJ sequences with 2+ Extended_Pictographic
+	if (segment.includes('\u200D')) {
+		const pictographics = segment.match(extendedPictographicRegex);
+		return pictographics !== null && pictographics.length >= 2;
+	}
+
+	return false;
+}
+
 function baseVisible(segment) {
 	return segment.replace(leadingNonPrintingRegex, '');
 }
@@ -29,13 +56,91 @@ function isZeroWidthCluster(segment) {
 	return zeroWidthClusterRegex.test(segment);
 }
 
-function trailingHalfwidthWidth(segment, eastAsianWidthOptions) {
-	let extra = 0;
-	if (segment.length > 1) {
-		for (const char of segment.slice(1)) {
-			if (char >= '\uFF00' && char <= '\uFFEF') {
-				extra += eastAsianWidth(char.codePointAt(0), eastAsianWidthOptions);
+function isHangulLeadingJamo(codePoint) {
+	return (codePoint >= 0x11_00 && codePoint <= 0x11_5F)
+		|| (codePoint >= 0xA9_60 && codePoint <= 0xA9_7C);
+}
+
+function isHangulVowelJamo(codePoint) {
+	return (codePoint >= 0x11_60 && codePoint <= 0x11_A7)
+		|| (codePoint >= 0xD7_B0 && codePoint <= 0xD7_C6);
+}
+
+function isHangulTrailingJamo(codePoint) {
+	return (codePoint >= 0x11_A8 && codePoint <= 0x11_FF)
+		|| (codePoint >= 0xD7_CB && codePoint <= 0xD7_FB);
+}
+
+function isHangulJamo(codePoint) {
+	return isHangulLeadingJamo(codePoint)
+		|| isHangulVowelJamo(codePoint)
+		|| isHangulTrailingJamo(codePoint);
+}
+
+function hangulClusterWidth(visibleSegment, eastAsianWidthOptions) {
+	const codePoints = [];
+
+	for (const character of visibleSegment) {
+		if (zeroWidthClusterRegex.test(character)) {
+			continue;
+		}
+
+		codePoints.push(character.codePointAt(0));
+	}
+
+	if (codePoints.length === 0) {
+		return undefined;
+	}
+
+	let width = 0;
+
+	for (let index = 0; index < codePoints.length; index++) {
+		const codePoint = codePoints[index];
+		if (!isHangulJamo(codePoint)) {
+			if (width === 0) {
+				return undefined;
+			}
+
+			// Mixed cluster (e.g., L + precomposed syllable): use EAW for non-jamo remainder
+			for (let remaining = index; remaining < codePoints.length; remaining++) {
+				width += eastAsianWidth(codePoints[remaining], eastAsianWidthOptions);
 			}
+
+			return width;
+		}
+
+		// Modern Hangul L+V(+T) shapes as one syllable block. Unmatched jamo stay additive:
+		// U+1100 U+1100 U+1161 => U+1100 + (U+1100 U+1161) => 2 + 2.
+		if (
+			isHangulLeadingJamo(codePoint)
+			&& isHangulVowelJamo(codePoints[index + 1])
+		) {
+			width += 2;
+			index += isHangulTrailingJamo(codePoints[index + 2]) ? 2 : 1;
+			continue;
+		}
+
+		width += eastAsianWidth(codePoint, eastAsianWidthOptions);
+	}
+
+	return width;
+}
+
+function trailingWidth(visibleSegment, eastAsianWidthOptions) {
+	let extra = 0;
+	let first = true;
+
+	for (const character of visibleSegment) {
+		if (first) {
+			first = false;
+			continue;
+		}
+
+		if (
+			spacingMarkRegex.test(character)
+			|| (character >= '\uFF00' && character <= '\uFFEF')
+		) {
+			extra += eastAsianWidth(character.codePointAt(0), eastAsianWidthOptions);
 		}
 	}
 
@@ -54,7 +159,8 @@ export default function stringWidth(input, options = {}) {
 
 	let string = input;
 
-	if (!countAnsiEscapeCodes) {
+	// Avoid calling stripAnsi when there are no ANSI escape sequences (ESC = 0x1B, CSI = 0x9B)
+	if (!countAnsiEscapeCodes && (string.includes('\u001B') || string.includes('\u009B'))) {
 		string = stripAnsi(string);
 	}
 
@@ -62,6 +168,11 @@ export default function stringWidth(input, options = {}) {
 		return 0;
 	}
 
+	// Fast path: printable ASCII (0x20–0x7E) needs no segmenter, regex, or EAW lookup — width equals length.
+	if (/^[\u0020-\u007E]*$/.test(string)) {
+		return string.length;
+	}
+
 	let width = 0;
 	const eastAsianWidthOptions = {ambiguousAsWide: !ambiguousIsNarrow};
 
@@ -72,17 +183,24 @@ export default function stringWidth(input, options = {}) {
 		}
 
 		// Emoji width logic
-		if (rgiEmojiRegex.test(segment)) {
+		if (rgiEmojiRegex.test(segment) || isDoubleWidthNonRgiEmojiSequence(segment)) {
 			width += 2;
 			continue;
 		}
 
+		const visibleSegment = baseVisible(segment);
+		const hangulWidth = hangulClusterWidth(visibleSegment, eastAsianWidthOptions);
+		if (hangulWidth !== undefined) {
+			width += hangulWidth;
+			continue;
+		}
+
 		// Everything else: EAW of the cluster’s first visible scalar
-		const codePoint = baseVisible(segment).codePointAt(0);
+		const codePoint = visibleSegment.codePointAt(0);
 		width += eastAsianWidth(codePoint, eastAsianWidthOptions);
 
-		// Add width for trailing Halfwidth and Fullwidth Forms (e.g., ﾞ, ﾟ, ｰ)
-		width += trailingHalfwidthWidth(segment, eastAsianWidthOptions);
+		// Add width for trailing spacing marks and Halfwidth/Fullwidth Forms (e.g., ﾞ, ﾟ, ｰ)
+		width += trailingWidth(visibleSegment, eastAsianWidthOptions);
 	}
 
 	return width;

package/node_modules/cli-truncate/node_modules/string-width/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "string-width",
-	"version": "8.1.0",
+	"version": "8.2.2",
 	"description": "Get the visual width of a string - the number of columns required to display it",
 	"license": "MIT",
 	"repository": "sindresorhus/string-width",
@@ -54,12 +54,12 @@
 		"east-asian-width"
 	],
 	"dependencies": {
-		"get-east-asian-width": "^1.3.0",
-		"strip-ansi": "^7.1.0"
+		"get-east-asian-width": "^1.5.0",
+		"strip-ansi": "^7.1.2"
 	},
 	"devDependencies": {
 		"ava": "^6.4.1",
 		"tsd": "^0.33.0",
-		"xo": "^1.2.2"
+		"xo": "^1.2.3"
 	}
 }

package/node_modules/cli-truncate/node_modules/string-width/readme.md

@@ -2,7 +2,7 @@
 
 > Get the visual width of a string - the number of columns required to display it
 
-Some Unicode characters are [fullwidth](https://en.wikipedia.org/wiki/Halfwidth_and_fullwidth_forms) and use double the normal width. [ANSI escape codes](https://en.wikipedia.org/wiki/ANSI_escape_code) are stripped and doesn't affect the width.
+Some Unicode characters are [fullwidth](https://en.wikipedia.org/wiki/Halfwidth_and_fullwidth_forms) and use double the normal width. [ANSI escape codes](https://en.wikipedia.org/wiki/ANSI_escape_code) are stripped and do not affect the width.
 
 Useful to be able to measure the actual width of command-line output.
 

package/node_modules/cli-truncate/package.json

@@ -1,9 +1,9 @@
 {
 	"name": "cli-truncate",
-	"version": "5.1.1",
+	"version": "6.1.1",
 	"description": "Truncate a string to a specific width in the terminal",
 	"license": "MIT",
-	"repository": "sindresorhus/cli-truncate",
+	"repository": "github:sindresorhus/cli-truncate",
 	"funding": "https://github.com/sponsors/sindresorhus",
 	"author": {
 		"name": "Sindre Sorhus",
@@ -17,7 +17,7 @@
 	},
 	"sideEffects": false,
 	"engines": {
-		"node": ">=20"
+		"node": ">=22"
 	},
 	"scripts": {
 		"test": "xo && ava && tsd"
@@ -41,12 +41,12 @@
 		"string"
 	],
 	"dependencies": {
-		"slice-ansi": "^7.1.0",
-		"string-width": "^8.0.0"
+		"slice-ansi": "^9.0.0",
+		"string-width": "^8.2.0"
 	},
 	"devDependencies": {
-		"ava": "^6.4.1",
+		"ava": "^7.0.0",
 		"tsd": "^0.33.0",
-		"xo": "^1.2.2"
+		"xo": "^2.0.2"
 	}
 }

package/node_modules/cli-truncate/readme.md

@@ -44,7 +44,7 @@ cliTruncate('안녕하세요', 3);
 
 // Truncate the paragraph to the terminal width
 const paragraph = 'Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Aenean commodo ligula eget dolor. Aenean massa.';
-cliTruncate(paragraph, process.stdout.columns);
+cliTruncate(paragraph, process.stdout.columns ?? 80);
 //=> 'Lorem ipsum dolor sit amet, consectetuer adipiscing…'
 ```
 
@@ -62,7 +62,7 @@ The text to truncate.
 
 Type: `number`
 
-The number of columns to occupy in the terminal.
+The finite number of columns to occupy in the terminal.
 
 #### options
 
@@ -145,7 +145,6 @@ cliTruncate('unicorns', 5, {position: 'end', truncationCharacter: '.'});
 
 cliTruncate('unicorns', 5, {position: 'end', truncationCharacter: ''});
 //=> 'unico'
-
 ```
 
 ## Related

package/node_modules/ghauth/.github/dependabot.yml

@@ -3,18 +3,26 @@ updates:
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
-      interval: 'daily'
+      interval: 'weekly'
     commit-message:
       prefix: 'chore'
       include: 'scope'
     cooldown:
-      default-days: 5
+      default-days: 2
+    groups:
+      github-actions-minor-patch:
+        patterns: ['*']
+        update-types: ['minor', 'patch']
   - package-ecosystem: 'npm'
     directory: '/'
     schedule:
-      interval: 'daily'
+      interval: 'monthly'
     commit-message:
       prefix: 'chore'
       include: 'scope'
     cooldown:
       default-days: 5
+    groups:
+      npm-minor-patch:
+        patterns: ['*']
+        update-types: ['minor', 'patch']

package/node_modules/ghauth/.github/workflows/depsound.yml

@@ -0,0 +1,33 @@
+# Copy into .github/workflows/ of the repo you want reviewed. One workflow,
+# two jobs: review computes with a read-only token, post holds the write
+# scopes. The README explains the security model.
+#
+# pull_request_target runs the base branch's workflow definition and action
+# pin (a PR cannot modify what executes here), and its token can post the
+# comment, including on Dependabot and fork PRs whose own token is read-only.
+# It is safe here because no PR code is ever checked out or executed: the
+# review job reads the PR's manifest bytes as git objects, and depsound's
+# parsers treat all of it as hostile data.
+name: depsound
+on:
+  pull_request_target:
+
+permissions: {} # scopes are granted per job below
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # diff the PR's manifests; this job never sees a write token
+    steps:
+      - uses: rvagg/depsound-action@7c7eb2bfc936dc8242f0592f6d7c4f9835510380 # v0.3.6
+  post:
+    needs: review
+    if: ${{ always() && needs.review.result != 'cancelled' }} # a failed review still posts its failure marker
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write # upsert the sticky comment
+      checks: write        # set the neutral check
+      actions: read        # download the report artifact
+    steps:
+      - uses: rvagg/depsound-action/post@7c7eb2bfc936dc8242f0592f6d7c4f9835510380 # v0.3.6

package/node_modules/ghauth/.github/workflows/test-and-release.yml

@@ -11,9 +11,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Use Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
       - name: Install Dependencies
@@ -37,11 +37,11 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Setup Node.js
-        uses: actions/setup-node@v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: lts/*
           registry-url: 'https://registry.npmjs.org'

package/node_modules/ghauth/CHANGELOG.md

@@ -1,3 +1,63 @@
+## [7.0.14](https://github.com/rvagg/ghauth/compare/v7.0.13...v7.0.14) (2026-08-03)
+
+### Trivial Changes
+
+* **deps-dev:** bump @semantic-release/git from 10.0.1 to 11.0.1 ([#85](https://github.com/rvagg/ghauth/issues/85)) ([4a5388e](https://github.com/rvagg/ghauth/commit/4a5388eeb135a66fa17fd610108ffe42711655e7))
+
+## [7.0.13](https://github.com/rvagg/ghauth/compare/v7.0.12...v7.0.13) (2026-08-03)
+
+### Trivial Changes
+
+* **deps-dev:** bump @semantic-release/changelog from 6.0.3 to 7.0.0 ([#86](https://github.com/rvagg/ghauth/issues/86)) ([28fbcb6](https://github.com/rvagg/ghauth/commit/28fbcb692a14d2ca75addd5107df0644c161c219))
+
+## [7.0.12](https://github.com/rvagg/ghauth/compare/v7.0.11...v7.0.12) (2026-08-03)
+
+### Trivial Changes
+
+* **deps:** bump the github-actions-minor-patch group with 2 updates ([#84](https://github.com/rvagg/ghauth/issues/84)) ([efc0ade](https://github.com/rvagg/ghauth/commit/efc0adea058134094bf088f8f0a21bace0ec395b))
+
+## [7.0.11](https://github.com/rvagg/ghauth/compare/v7.0.10...v7.0.11) (2026-07-30)
+
+### Trivial Changes
+
+* downgrade broken changelog maker, backfill entries ([#83](https://github.com/rvagg/ghauth/issues/83)) ([c3c5116](https://github.com/rvagg/ghauth/commit/c3c51167d5633a04e0b8a304e33c2baee4798131))
+
+## [7.0.10](https://github.com/rvagg/ghauth/compare/v7.0.9...v7.0.10) (2026-07-27)
+
+### Trivial Changes
+
+* **deps:** bump the github-actions-minor-patch group with 2 updates ([#82](https://github.com/rvagg/ghauth/issues/82)) ([fb63a52](https://github.com/rvagg/ghauth/commit/fb63a5248cfa7bd49928012399db9f11649a516f))
+
+## [7.0.9](https://github.com/rvagg/ghauth/compare/v7.0.8...v7.0.9) (2026-07-21)
+
+### Trivial Changes
+
+* **ci:** slow down dependabot, add depsound, pin actions by hash ([#81](https://github.com/rvagg/ghauth/issues/81)) ([8c926f0](https://github.com/rvagg/ghauth/commit/8c926f0724faba99c24e0c27f5d1cb1beb4ccf00))
+
+## [7.0.8](https://github.com/rvagg/ghauth/compare/v7.0.7...v7.0.8) (2026-07-03)
+
+### Trivial Changes
+
+* **deps-dev:** bump conventional-changelog-conventionalcommits ([#79](https://github.com/rvagg/ghauth/issues/79)) ([e3fe99c](https://github.com/rvagg/ghauth/commit/e3fe99c5f9a599cc2a2bd18a33c8dd4bf8868cc7))
+
+## [7.0.7](https://github.com/rvagg/ghauth/compare/v7.0.6...v7.0.7) (2026-06-23)
+
+### Trivial Changes
+
+* **deps:** bump actions/checkout from 6.0.3 to 7.0.0 ([#78](https://github.com/rvagg/ghauth/issues/78)) ([89835fa](https://github.com/rvagg/ghauth/commit/89835fa08fd0aca5cd36a0b8721487722e38ae9b))
+
+## [7.0.6](https://github.com/rvagg/ghauth/compare/v7.0.5...v7.0.6) (2026-06-22)
+
+### Trivial Changes
+
+* **deps:** bump actions/checkout from 6.0.2 to 6.0.3 ([#77](https://github.com/rvagg/ghauth/issues/77)) ([caff007](https://github.com/rvagg/ghauth/commit/caff007a92d47528b608086f5803059ef37e2958))
+
+## [7.0.5](https://github.com/rvagg/ghauth/compare/v7.0.4...v7.0.5) (2026-06-03)
+
+### Trivial Changes
+
+* **deps:** bump actions/checkout from 6 to 6.0.2 ([#76](https://github.com/rvagg/ghauth/issues/76)) ([d501244](https://github.com/rvagg/ghauth/commit/d501244719f3f147576a93d91e7dfa0faa0ed1e0))
+
 ## [7.0.4](https://github.com/rvagg/ghauth/compare/v7.0.3...v7.0.4) (2026-05-21)
 
 ### Trivial Changes

package/node_modules/ghauth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghauth",
-  "version": "7.0.4",
+  "version": "7.0.14",
   "description": "Create and load persistent GitHub authentication tokens for command-line apps",
   "type": "module",
   "exports": "./ghauth.js",
@@ -35,13 +35,13 @@
     "read": "^6.0.0"
   },
   "devDependencies": {
-    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/changelog": "^7.0.0",
     "@semantic-release/commit-analyzer": "^13.0.0",
-    "@semantic-release/git": "^10.0.1",
+    "@semantic-release/git": "^11.0.1",
     "@semantic-release/github": "^12.0.0",
     "@semantic-release/npm": "^13.0.0",
     "@semantic-release/release-notes-generator": "^14.0.1",
-    "conventional-changelog-conventionalcommits": "^9.0.0",
+    "conventional-changelog-conventionalcommits": "^9.3.1",
     "semantic-release": "^25.0.0",
     "standard": "^17.1.2"
   },
@@ -104,6 +104,30 @@
                 "type": "fix",
                 "section": "Bug Fixes"
               },
+              {
+                "type": "perf",
+                "section": "Performance Improvements"
+              },
+              {
+                "type": "revert",
+                "section": "Reverts"
+              },
+              {
+                "type": "refactor",
+                "section": "Code Refactoring"
+              },
+              {
+                "type": "test",
+                "section": "Tests"
+              },
+              {
+                "type": "build",
+                "section": "Trivial Changes"
+              },
+              {
+                "type": "ci",
+                "section": "Trivial Changes"
+              },
               {
                 "type": "chore",
                 "section": "Trivial Changes"
@@ -113,8 +137,8 @@
                 "section": "Trivial Changes"
               },
               {
-                "type": "test",
-                "section": "Tests"
+                "type": "style",
+                "section": "Trivial Changes"
               }
             ]
           }