@openclaw/feishu 2026.9.4 → 2026.9.5

package/node_modules/@larksuiteoapi/node-sdk/node_modules/axios/lib/helpers/toFormData.js

@@ -99,28 +99,18 @@ function toFormData(obj, formData, options) {
   // eslint-disable-next-line no-param-reassign
   formData = formData || new (PlatformFormData || FormData)();
 
-  // eslint-disable-next-line no-param-reassign
-  options = utils.toFlatObject(
-    options,
-    {
-      metaTokens: true,
-      dots: false,
-      indexes: false,
-    },
-    false,
-    function defined(option, source) {
-      // eslint-disable-next-line no-eq-null,eqeqeq
-      return !utils.isUndefined(source[option]);
-    }
-  );
+  const option = (name, fallback) => {
+    const value = utils.getSafeProp(options, name);
+    return utils.isUndefined(value) ? fallback : value;
+  };
 
-  const metaTokens = options.metaTokens;
+  const metaTokens = option('metaTokens', true);
   // eslint-disable-next-line no-use-before-define
-  const visitor = options.visitor || defaultVisitor;
-  const dots = options.dots;
-  const indexes = options.indexes;
-  const _Blob = options.Blob || (typeof Blob !== 'undefined' && Blob);
-  const maxDepth = options.maxDepth === undefined ? DEFAULT_FORM_DATA_MAX_DEPTH : options.maxDepth;
+  const visitor = option('visitor') || defaultVisitor;
+  const dots = option('dots', false);
+  const indexes = option('indexes', false);
+  const _Blob = option('Blob') || (typeof Blob !== 'undefined' && Blob);
+  const maxDepth = option('maxDepth', DEFAULT_FORM_DATA_MAX_DEPTH);
   const useBlob = _Blob && utils.isSpecCompliantForm(formData);
   const stack = [];
 
@@ -150,7 +140,10 @@ function toFormData(obj, formData, options) {
       if (PlatformBuffer && PlatformBuffer.isBufferAvailable()) {
         return PlatformBuffer.from(value);
       }
-      throw new AxiosError('Blob is not supported. Use a Buffer instead.', AxiosError.ERR_NOT_SUPPORT);
+      throw new AxiosError(
+        'Blob is not supported. Use a Buffer instead.',
+        AxiosError.ERR_NOT_SUPPORT
+      );
     }
 
     return value;

package/node_modules/@larksuiteoapi/node-sdk/node_modules/axios/lib/utils.js

@@ -15,12 +15,65 @@ const hasOwnProperty = (
     hasOwnProperty.call(obj, prop)
 )(Object.prototype);
 
+const isUnsafeObjectKey = (prop) =>
+  typeof prop === 'string' &&
+  (prop === '__proto__' || prop === 'constructor' || prop === 'prototype');
+
+/**
+ * Determine whether an inherited object must be treated as a shared-prototype
+ * boundary. Cross-realm Object.prototype objects cannot be distinguished
+ * reliably from application-created null-prototype objects because their
+ * properties are mutable, so all inherited terminal prototypes are excluded
+ * as a fail-closed boundary. A null-prototype source still keeps its own
+ * properties, as produced by mergeConfig and other safe materialization paths.
+ *
+ * @param {*} obj The object to inspect
+ * @param {*} prototype The object's prototype
+ * @param {boolean} source Whether obj is the original traversal source
+ *
+ * @returns {boolean} True when obj is a safe prototype traversal boundary
+ */
+const isPrototypeBoundary = (obj, prototype, source) =>
+  obj === Object.prototype || (!source && prototype === null);
+
+/**
+ * Determine whether an object can retain its identity through code paths that
+ * add, replace, and remove config properties without bypassing unsafe-key
+ * filtering. Immutable objects, unsafe-key-bearing objects, and objects with
+ * accessor or restricted data properties must be materialized instead.
+ *
+ * @param {*} obj The object to inspect
+ *
+ * @returns {boolean} True when every own property is safe and fully mutable
+ */
+const isSafeAndFullyMutable = (obj) => {
+  if (!Object.isExtensible(obj)) {
+    return false;
+  }
+
+  const props = Object.getOwnPropertyNames(obj);
+
+  if (Object.getOwnPropertySymbols) {
+    props.push(...Object.getOwnPropertySymbols(obj));
+  }
+
+  return props.every((prop) => {
+    if (isUnsafeObjectKey(prop)) {
+      return false;
+    }
+
+    const descriptor = Object.getOwnPropertyDescriptor(obj, prop);
+
+    return !!descriptor && descriptor.configurable && descriptor.writable === true;
+  });
+};
+
 /**
- * Walk the prototype chain (excluding the shared Object.prototype) looking for
- * an own `prop`. This distinguishes genuine own/inherited members — including
- * class accessors and template prototypes — from members injected via
- * Object.prototype pollution (e.g. `Object.prototype.username = '...'`), which
- * live on Object.prototype itself and are therefore never matched.
+ * Walk the prototype chain (excluding the source realm's Object.prototype)
+ * looking for an own `prop`. This distinguishes genuine own/inherited members
+ * — including class accessors and template prototypes — from members injected
+ * via Object.prototype pollution (e.g. `Object.prototype.username = '...'`),
+ * which live on Object.prototype itself and are therefore never matched.
  *
  * @param {*} thing The value whose chain to inspect
  * @param {string|symbol} prop The property key to look for
@@ -31,16 +84,22 @@ const hasOwnInPrototypeChain = (thing, prop) => {
   let obj = thing;
   const seen = [];
 
-  while (obj != null && obj !== Object.prototype) {
+  while (obj != null) {
     if (seen.indexOf(obj) !== -1) {
       return false;
     }
     seen.push(obj);
 
+    const prototype = getPrototypeOf(obj);
+
+    if (isPrototypeBoundary(obj, prototype, obj === thing)) {
+      return false;
+    }
+
     if (hasOwnProperty(obj, prop)) {
       return true;
     }
-    obj = getPrototypeOf(obj);
+    obj = prototype;
   }
   return false;
 };
@@ -59,6 +118,69 @@ const hasOwnInPrototypeChain = (thing, prop) => {
 const getSafeProp = (obj, prop) =>
   obj != null && hasOwnInPrototypeChain(obj, prop) ? obj[prop] : undefined;
 
+/**
+ * Flatten an object and its application-defined prototype chain into a
+ * null-prototype object. Members inherited only from the source realm's
+ * Object.prototype are deliberately excluded, while class/template members
+ * below that boundary are preserved.
+ *
+ * @param {*} thing The value to flatten
+ *
+ * @returns {*} A null-prototype copy, or the original value when it is already
+ * structurally safe or is not an object
+ */
+const toSafeFlatObject = (thing) => {
+  if (thing == null || (typeof thing !== 'object' && typeof thing !== 'function')) {
+    return thing;
+  }
+
+  const sourcePrototype = getPrototypeOf(thing);
+
+  if (sourcePrototype === null && isSafeAndFullyMutable(thing)) {
+    return thing;
+  }
+
+  const result = Object.create(null);
+  const merged = Object.create(null);
+  const seen = [];
+  let current = thing;
+
+  while (current != null) {
+    if (seen.indexOf(current) !== -1) {
+      break;
+    }
+
+    seen.push(current);
+
+    const prototype = current === thing ? sourcePrototype : getPrototypeOf(current);
+
+    if (isPrototypeBoundary(current, prototype, current === thing)) {
+      break;
+    }
+
+    const props = Object.getOwnPropertyNames(current);
+
+    if (Object.getOwnPropertySymbols) {
+      props.push(...Object.getOwnPropertySymbols(current));
+    }
+
+    for (const prop of props) {
+      if (isUnsafeObjectKey(prop)) {
+        continue;
+      }
+
+      if (!hasOwnProperty(merged, prop)) {
+        result[prop] = thing[prop];
+        merged[prop] = true;
+      }
+    }
+
+    current = prototype;
+  }
+
+  return result;
+};
+
 const kindOf = ((cache) => (thing) => {
   const str = toString.call(thing);
   return cache[str] || (cache[str] = str.slice(8, -1).toLowerCase());
@@ -190,12 +312,10 @@ const isPlainObject = (val) => {
 
   const prototype = getPrototypeOf(val);
   return (
-    (prototype === null ||
-      prototype === Object.prototype ||
-      getPrototypeOf(prototype) === null) &&
-    // Treat any genuine (non-Object.prototype-polluted) Symbol.toStringTag or
-    // Symbol.iterator as evidence the value is a tagged/iterable type rather
-    // than a plain object, while ignoring keys injected onto Object.prototype.
+    (prototype === null || prototype === Object.prototype || getPrototypeOf(prototype) === null) &&
+    // Treat safe own/inherited Symbol.toStringTag or Symbol.iterator members as
+    // evidence the value is tagged/iterable, while ignoring members reachable
+    // only through shared or terminal prototype boundaries.
     !hasOwnInPrototypeChain(val, toStringTag) &&
     !hasOwnInPrototypeChain(val, iterator)
   );
@@ -1009,6 +1129,7 @@ export default {
   hasOwnProp: hasOwnProperty, // an alias to avoid ESLint no-prototype-builtins detection
   hasOwnInPrototypeChain,
   getSafeProp,
+  toSafeFlatObject,
   reduceDescriptors,
   freezeMethods,
   toObjectSet,

package/node_modules/@larksuiteoapi/node-sdk/node_modules/axios/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axios",
-  "version": "1.19.0",
+  "version": "1.20.0",
   "description": "Promise based HTTP client for the browser and node.js",
   "main": "./dist/node/axios.cjs",
   "module": "./index.js",

package/node_modules/@larksuiteoapi/node-sdk/node_modules/protobufjs/README.md

@@ -316,26 +316,32 @@ protobuf.js is validated against the official Protocol Buffers conformance suite
 | ↳ Proto2   |   100.00% (707/707) |   100.00% (489/489) |   100.00% (218/218) |
 | ↳ Proto3   |   100.00% (707/707) |   100.00% (486/486) |   100.00% (221/221) |
 | ↳ Editions | 100.00% (1421/1421) |   100.00% (983/983) |   100.00% (438/438) |
-| ProtoJSON  | 100.00% (2796/2796) | 100.00% (2362/2362) |   100.00% (434/434) |
+| ProtoJSON  | 100.00% (2814/2814) | 100.00% (2362/2362) |   100.00% (452/452) |
 | TextFormat |   100.00% (909/909) |   100.00% (845/845) |     100.00% (64/64) |
-| Overall    | 100.00% (6540/6540) | 100.00% (5165/5165) | 100.00% (1375/1375) |
+| Overall    | 100.00% (6558/6558) | 100.00% (5165/5165) | 100.00% (1393/1393) |
 
 <!-- END CONFORMANCE DATA -->
 
+| Edition | Supported since
+|---------|----------------
+| 2023    | v7.5.0
+| 2024    | v8.0.0
+| 2026    | v8.8.0
+
 [Structured results](https://github.com/protobufjs/protobuf.js/actions/workflows/test.yml?query=branch%3Amaster+event%3Apush) of the conformance tests are also available as CI artifacts.
 
 ## Performance
 
-Both reflection and static modes use specialized encoders and decoders backed by the same hand-tuned reader and writer primitives.
+protobuf.js's reflection and static modes share the same code-generation backend and underlying hand-tuned reader and writer primitives. Reflection mode emits specialized encoders and decoders just in time, while static mode emits equivalent code ahead of time.
 
-The repository includes a [benchmark suite](./bench) you can run yourself. It compares protobuf.js with other general-purpose JavaScript implementations across three substantially different cases: our classic common message shape and two unmodified, structurally distinct fixtures sourced externally. The suite measures each library's recommended serialization and deserialization path using identical schemas and inputs, with JSON included as an additional baseline. Across these cases, protobuf.js is a clear upgrade over using JSON and consistently the fastest Protobuf implementation by a considerable margin.
+To see how this architecture compares in practice, the repository includes a reproducible [benchmark suite](./bench) measuring both modes alongside other general-purpose JavaScript implementations across three cases: our classic common message shape and two unmodified, structurally distinct fixtures sourced from other implementations. Each library is tested through its recommended serialization and deserialization path using identical schemas and message contents.
 
 <!-- BEGIN BENCHMARK DATA -->
 
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="./bench/results/encode-dark.svg">
   <source media="(prefers-color-scheme: light)" srcset="./bench/results/encode-light.svg">
-  <img alt="Encode benchmark" src="./bench/results/encode.svg">
+  <img alt="Encode Throughput" src="./bench/results/encode.svg">
 </picture>
 
 <details>
@@ -343,18 +349,18 @@ The repository includes a [benchmark suite](./bench) you can run yourself. It co
 
 | Implementation | Common | Vector tile | Buf perf |
 | --- | ---: | ---: | ---: |
-| protobuf.js static | **5.34M ops/s** &nbsp; <small>1.0x</small> | **3.09K ops/s** &nbsp; <small>1.0x</small> | 43.1K ops/s &nbsp; <small>1.0x</small> |
-| protobuf.js reflect | 4.89M ops/s &nbsp; <small>1.1x</small> | 3.03K ops/s &nbsp; <small>1.0x</small> | **43.3K ops/s** &nbsp; <small>1.0x</small> |
-| JSON | 2.09M ops/s &nbsp; <small>2.6x</small> | 897 ops/s &nbsp; <small>3.4x</small> | 6.70K ops/s &nbsp; <small>6.5x</small> |
-| protoc-gen-js | 1.03M ops/s &nbsp; <small>5.2x</small> | 700 ops/s &nbsp; <small>4.4x</small> | 13.9K ops/s &nbsp; <small>3.1x</small> |
-| protoc-gen-es | 402K ops/s &nbsp; <small>13.3x</small> | 235 ops/s &nbsp; <small>13.2x</small> | 8.22K ops/s &nbsp; <small>5.3x</small> |
+| protobuf.js static | **5.28M ops/s** &nbsp; <small>1.0x</small> | 3.06K ops/s &nbsp; <small>1.0x</small> | **49.2K ops/s** &nbsp; <small>1.0x</small> |
+| protobuf.js reflect | 5.16M ops/s &nbsp; <small>1.0x</small> | **3.08K ops/s** &nbsp; <small>1.0x</small> | 47.5K ops/s &nbsp; <small>1.0x</small> |
+| JSON | 3.44M ops/s &nbsp; <small>1.5x</small> | 1.50K ops/s &nbsp; <small>2.1x</small> | 7.13K ops/s &nbsp; <small>6.9x</small> |
+| protoc-gen-js | 1.05M ops/s &nbsp; <small>5.0x</small> | 691 ops/s &nbsp; <small>4.5x</small> | 15.0K ops/s &nbsp; <small>3.3x</small> |
+| protoc-gen-es | 1.22M ops/s &nbsp; <small>4.3x</small> | 1.14K ops/s &nbsp; <small>2.7x</small> | 35.8K ops/s &nbsp; <small>1.4x</small> |
 
 </details>
 
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="./bench/results/decode-dark.svg">
   <source media="(prefers-color-scheme: light)" srcset="./bench/results/decode-light.svg">
-  <img alt="Decode benchmark" src="./bench/results/decode.svg">
+  <img alt="Decode Throughput" src="./bench/results/decode.svg">
 </picture>
 
 <details>
@@ -362,22 +368,23 @@ The repository includes a [benchmark suite](./bench) you can run yourself. It co
 
 | Implementation | Common | Vector tile | Buf perf |
 | --- | ---: | ---: | ---: |
-| protobuf.js static | 6.45M ops/s &nbsp; <small>1.1x</small> | 2.70K ops/s &nbsp; <small>1.1x</small> | **81.7K ops/s** &nbsp; <small>1.0x</small> |
-| protobuf.js reflect | **6.93M ops/s** &nbsp; <small>1.0x</small> | **2.99K ops/s** &nbsp; <small>1.0x</small> | 80.3K ops/s &nbsp; <small>1.0x</small> |
-| JSON | 1.37M ops/s &nbsp; <small>5.0x</small> | 1.06K ops/s &nbsp; <small>2.8x</small> | 19.5K ops/s &nbsp; <small>4.2x</small> |
-| protoc-gen-js | 811K ops/s &nbsp; <small>8.5x</small> | 851 ops/s &nbsp; <small>3.5x</small> | 21.7K ops/s &nbsp; <small>3.8x</small> |
-| protoc-gen-es | 691K ops/s &nbsp; <small>10.0x</small> | 376 ops/s &nbsp; <small>8.0x</small> | 14.3K ops/s &nbsp; <small>5.7x</small> |
+| protobuf.js static | 5.84M ops/s &nbsp; <small>1.1x</small> | 2.45K ops/s &nbsp; <small>1.1x</small> | **78.9K ops/s** &nbsp; <small>1.0x</small> |
+| protobuf.js reflect | **6.54M ops/s** &nbsp; <small>1.0x</small> | **2.66K ops/s** &nbsp; <small>1.0x</small> | 77.0K ops/s &nbsp; <small>1.0x</small> |
+| JSON | 1.58M ops/s &nbsp; <small>4.1x</small> | 1.21K ops/s &nbsp; <small>2.2x</small> | 21.0K ops/s &nbsp; <small>3.8x</small> |
+| protoc-gen-js | 701K ops/s &nbsp; <small>9.3x</small> | 946 ops/s &nbsp; <small>2.8x</small> | 21.5K ops/s &nbsp; <small>3.7x</small> |
+| protoc-gen-es | 1.67M ops/s &nbsp; <small>3.9x</small> | 1.19K ops/s &nbsp; <small>2.2x</small> | 31.0K ops/s &nbsp; <small>2.5x</small> |
 
 </details>
 
 <!-- END BENCHMARK DATA -->
 
-[Structured results](./bench/results/latest.json) and environment details for this run are also available as committed artifacts.
+[Structured results](./bench/results/latest.json) include environment details for this run and are committed alongside the charts. The suite also runs in CI.
 
 To run the benchmark on your own hardware:
 
 ```sh
 npm --prefix bench install
+npm --prefix bench run generate
 npm run bench
 ```