@openclaw/lobster 2026.6.33 → 2026.6.34

package/node_modules/fast-uri/lib/utils.js

@@ -15,6 +15,9 @@ const isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu)
 /** @type {(value: string) => boolean} */
 const isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu)
 
+/** @type {(value: string) => boolean} */
+const isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/?]$/iu)
+
 /**
  * @param {Array<string>} input
  * @returns {string}
@@ -218,7 +221,7 @@ function removeDotSegments (path) {
           continue
         }
       } else if (input[0] === '/') {
-        if (input[1] === '.' || input[1] === '/') {
+        if (input[1] === '.') {
           output.push('/')
           break
         }
@@ -331,6 +334,55 @@ function normalizePercentEncoding (input, decodeUnreserved = false) {
   return output
 }
 
+/** Pre-built `%XX` strings for every byte. Avoids per-call hex math/concat. */
+const BYTE_HEX = new Array(256)
+{
+  const HEX_DIGITS = '0123456789ABCDEF'
+  for (let i = 0; i < 256; i++) {
+    BYTE_HEX[i] = '%' + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 0xF]
+  }
+}
+
+/**
+ * Mirrors the pass-through set of the deprecated `escape()` global:
+ * `A-Z a-z 0-9 * + - . / @ _`. Keeps drop-in semantics for ASCII input.
+ *
+ * @param {number} cp
+ * @returns {boolean}
+ */
+function isEscapeSafe (cp) {
+  return (
+    (cp >= 0x30 && cp <= 0x39) ||
+    (cp >= 0x41 && cp <= 0x5A) ||
+    (cp >= 0x61 && cp <= 0x7A) ||
+    cp === 0x2A || cp === 0x2B || cp === 0x2D || cp === 0x2E ||
+    cp === 0x2F || cp === 0x40 || cp === 0x5F
+  )
+}
+
+/**
+ * RFC 3986 percent-encode a non-ASCII Unicode code point as UTF-8 bytes.
+ * Caller handles the ASCII branch inline for speed.
+ *
+ * @param {number} cp - Unicode code point (>= 0x80, <= 0x10FFFF)
+ * @returns {string}
+ */
+function percentEncodeNonAscii (cp) {
+  if (cp < 0x800) {
+    return BYTE_HEX[0xC0 | (cp >> 6)] +
+           BYTE_HEX[0x80 | (cp & 0x3F)]
+  }
+  if (cp < 0x10000) {
+    return BYTE_HEX[0xE0 | (cp >> 12)] +
+           BYTE_HEX[0x80 | ((cp >> 6) & 0x3F)] +
+           BYTE_HEX[0x80 | (cp & 0x3F)]
+  }
+  return BYTE_HEX[0xF0 | (cp >> 18)] +
+         BYTE_HEX[0x80 | ((cp >> 12) & 0x3F)] +
+         BYTE_HEX[0x80 | ((cp >> 6) & 0x3F)] +
+         BYTE_HEX[0x80 | (cp & 0x3F)]
+}
+
 /**
  * Normalizes path data without turning reserved escapes into live path syntax.
  * Valid escapes are uppercased, raw unsafe characters are escaped, and only
@@ -343,7 +395,8 @@ function normalizePathEncoding (input) {
   let output = ''
 
   for (let i = 0; i < input.length; i++) {
-    if (input[i] === '%' && i + 2 < input.length) {
+    const ch = input[i]
+    if (ch === '%' && i + 2 < input.length) {
       const hex = input.slice(i + 1, i + 3)
       if (isHexPair(hex)) {
         const normalizedHex = hex.toUpperCase()
@@ -360,10 +413,82 @@ function normalizePathEncoding (input) {
       }
     }
 
-    if (isPathCharacter(input[i])) {
-      output += input[i]
+    if (isPathCharacter(ch)) {
+      output += ch
     } else {
-      output += escape(input[i])
+      const code = input.charCodeAt(i)
+      if (code < 0x80) {
+        output += isEscapeSafe(code) ? ch : BYTE_HEX[code]
+      } else if (code < 0xD800 || code > 0xDFFF) {
+        output += percentEncodeNonAscii(code)
+      } else if (code <= 0xDBFF && i + 1 < input.length) {
+        const low = input.charCodeAt(i + 1)
+        if (low >= 0xDC00 && low <= 0xDFFF) {
+          output += percentEncodeNonAscii(0x10000 + ((code - 0xD800) << 10) + (low - 0xDC00))
+          i++
+        } else {
+          output += percentEncodeNonAscii(0xFFFD)
+        }
+      } else {
+        output += percentEncodeNonAscii(0xFFFD)
+      }
+    }
+  }
+
+  return output
+}
+
+/**
+ * Normalizes the percent-encoding of a query or fragment component.
+ *
+ * Like `normalizePathEncoding`, but uses the query/fragment character set
+ * (which additionally allows `?`) and decodes `.` since it has no dot-segment
+ * meaning outside of a path.
+ *
+ * @param {string} input
+ * @returns {string}
+ */
+function normalizeQueryFragmentEncoding (input) {
+  let output = ''
+
+  for (let i = 0; i < input.length; i++) {
+    const ch = input[i]
+    if (ch === '%' && i + 2 < input.length) {
+      const hex = input.slice(i + 1, i + 3)
+      if (isHexPair(hex)) {
+        const normalizedHex = hex.toUpperCase()
+        const decoded = String.fromCharCode(parseInt(normalizedHex, 16))
+
+        if (isUnreserved(decoded)) {
+          output += decoded
+        } else {
+          output += '%' + normalizedHex
+        }
+
+        i += 2
+        continue
+      }
+    }
+
+    if (isQueryFragmentCharacter(ch)) {
+      output += ch
+    } else {
+      const code = input.charCodeAt(i)
+      if (code < 0x80) {
+        output += isEscapeSafe(code) ? ch : BYTE_HEX[code]
+      } else if (code < 0xD800 || code > 0xDFFF) {
+        output += percentEncodeNonAscii(code)
+      } else if (code <= 0xDBFF && i + 1 < input.length) {
+        const low = input.charCodeAt(i + 1)
+        if (low >= 0xDC00 && low <= 0xDFFF) {
+          output += percentEncodeNonAscii(0x10000 + ((code - 0xD800) << 10) + (low - 0xDC00))
+          i++
+        } else {
+          output += percentEncodeNonAscii(0xFFFD)
+        }
+      } else {
+        output += percentEncodeNonAscii(0xFFFD)
+      }
     }
   }
 
@@ -380,7 +505,8 @@ function escapePreservingEscapes (input) {
   let output = ''
 
   for (let i = 0; i < input.length; i++) {
-    if (input[i] === '%' && i + 2 < input.length) {
+    const ch = input[i]
+    if (ch === '%' && i + 2 < input.length) {
       const hex = input.slice(i + 1, i + 3)
       if (isHexPair(hex)) {
         output += '%' + hex.toUpperCase()
@@ -389,7 +515,22 @@ function escapePreservingEscapes (input) {
       }
     }
 
-    output += escape(input[i])
+    const code = input.charCodeAt(i)
+    if (code < 0x80) {
+      output += isEscapeSafe(code) ? ch : BYTE_HEX[code]
+    } else if (code < 0xD800 || code > 0xDFFF) {
+      output += percentEncodeNonAscii(code)
+    } else if (code <= 0xDBFF && i + 1 < input.length) {
+      const low = input.charCodeAt(i + 1)
+      if (low >= 0xDC00 && low <= 0xDFFF) {
+        output += percentEncodeNonAscii(0x10000 + ((code - 0xD800) << 10) + (low - 0xDC00))
+        i++
+      } else {
+        output += percentEncodeNonAscii(0xFFFD)
+      }
+    } else {
+      output += percentEncodeNonAscii(0xFFFD)
+    }
   }
 
   return output
@@ -434,6 +575,7 @@ module.exports = {
   reescapeHostDelimiters,
   normalizePercentEncoding,
   normalizePathEncoding,
+  normalizeQueryFragmentEncoding,
   escapePreservingEscapes,
   removeDotSegments,
   isIPv4,

package/node_modules/fast-uri/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "3.1.2",
+  "version": "4.1.2",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",
@@ -48,14 +48,14 @@
   "scripts": {
     "lint": "eslint",
     "lint:fix": "eslint --fix",
-    "test": "npm run test:unit && npm run test:typescript",
+    "test": "npm run test:unit",
     "test:browser:chromium": "playwright-test ./test/* --runner tape --browser=chromium",
     "test:browser:firefox": "playwright-test ./test/* --runner tape --browser=firefox",
     "test:browser:webkit": "playwright-test ./test/* --runner tape --browser=webkit",
     "test:browser": "npm run test:browser:chromium && npm run test:browser:firefox && npm run test:browser:webkit",
     "test:unit": "tape test/**/*.js",
     "test:unit:dev": "npm run test:unit -- --coverage-report=html",
-    "test:typescript": "tsd"
+    "test:typescript": "tstyche"
   },
   "devDependencies": {
     "ajv": "^8.16.0",
@@ -63,6 +63,6 @@
     "neostandard": "^0.13.0",
     "playwright-test": "^14.1.12",
     "tape": "^5.8.1",
-    "tsd": "^0.33.0"
+    "tstyche": "^7.0.0"
   }
 }

package/node_modules/fast-uri/test/equal.test.js

@@ -115,3 +115,54 @@ test('URI Equals tolerates malformed fragments', (t) => {
   )
   t.end()
 })
+
+test('URI Equals — raw UTF-8 char equals its percent-encoded UTF-8 form', (t) => {
+  const suite = [
+    // BMP characters
+    { pair: ['http://example.com/日本', 'http://example.com/%E6%97%A5%E6%9C%AC'], result: true },
+    { pair: ['http://example.com/café', 'http://example.com/caf%C3%A9'], result: true },
+    { pair: ['http://example.com/€', 'http://example.com/%E2%82%AC'], result: true },
+    { pair: ['http://example.com/中文', 'http://example.com/%E4%B8%AD%E6%96%87'], result: true },
+    // supplementary plane (emoji, surrogate pairs)
+    { pair: ['http://example.com/🚀', 'http://example.com/%F0%9F%9A%80'], result: true },
+    { pair: ['http://example.com/😀', 'http://example.com/%F0%9F%98%80'], result: true },
+    // mixed encoded + raw in same path
+    { pair: ['http://example.com/users/日本/profile', 'http://example.com/users/%E6%97%A5%E6%9C%AC/profile'], result: true },
+    { pair: ['http://example.com/a/€/b', 'http://example.com/a/%E2%82%AC/b'], result: true }
+  ]
+  runTest(t, suite)
+  t.end()
+})
+
+test('URI Equals — percent-encoded UTF-8 is case-insensitive in hex digits', (t) => {
+  const suite = [
+    { pair: ['http://example.com/caf%C3%A9', 'http://example.com/caf%c3%a9'], result: true },
+    { pair: ['http://example.com/%E6%97%A5', 'http://example.com/%e6%97%a5'], result: true },
+    { pair: ['http://example.com/%F0%9F%9A%80', 'http://example.com/%f0%9f%9a%80'], result: true }
+  ]
+  runTest(t, suite)
+  t.end()
+})
+
+test('URI Equals — different Unicode code points are not equal', (t) => {
+  const suite = [
+    { pair: ['http://example.com/日本', 'http://example.com/中文'], result: false },
+    { pair: ['http://example.com/café', 'http://example.com/cafe'], result: false },
+    { pair: ['http://example.com/🚀', 'http://example.com/🎉'], result: false }
+  ]
+  runTest(t, suite)
+  t.end()
+})
+
+test('URI Equals — Latin-1 byte is not equal to UTF-8 multi-byte encoding', (t) => {
+  // Parser-differential guard: %C3%A9 (UTF-8 for "é") must NOT equal %E9
+  // (raw Latin-1 byte). The old escape() emitted single Latin-1 bytes for
+  // non-ASCII, which would have made these incorrectly compare equal in a
+  // round-tripped URI.
+  const suite = [
+    { pair: ['http://example.com/caf%C3%A9', 'http://example.com/caf%E9'], result: false },
+    { pair: ['http://example.com/%E6%97%A5', 'http://example.com/%E6'], result: false }
+  ]
+  runTest(t, suite)
+  t.end()
+})

package/node_modules/fast-uri/test/parse.test.js

@@ -150,10 +150,12 @@ test('URI parse', (t) => {
   t.equal(components.query, undefined, 'query')
   t.equal(components.fragment, '%0D', 'fragment')
 
-  // malformed percent-encoded fragment must not throw
+  // a fragment whose decoded bytes are not valid UTF-8 is still valid
+  // percent-encoding (RFC 3986 §2.1 is byte-level), so it is preserved as-is
+  // rather than being flagged as malformed
   components = fastURI.parse('http://example.com/#%E0%A4A')
-  t.equal(components.error, 'URI malformed', 'malformed fragment errors')
-  t.equal(components.fragment, '%E0%A4A', 'malformed fragment is preserved')
+  t.equal(components.error, undefined, 'valid percent-encoding is not flagged as malformed')
+  t.equal(components.fragment, '%E0%A4A', 'fragment is preserved')
 
   // all
   components = fastURI.parse('uri://user:pass@example.com:123/one/two.three?q1=a1&q2=a2#body')

package/node_modules/fast-uri/test/query-fragment-normalization.test.js

@@ -0,0 +1,33 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+test('query percent-encoding is normalized (RFC 3986 §6.2.2)', (t) => {
+  // hex digits are uppercased, like the path component already does
+  t.equal(fastURI.normalize('x://h/p?a=%2a'), 'x://h/p?a=%2A', 'uppercases hex in query')
+  // unreserved characters are decoded
+  t.equal(fastURI.normalize('x://h/p?a=%7e%2e'), 'x://h/p?a=~.', 'decodes unreserved in query')
+  // reserved characters stay percent-encoded
+  t.equal(fastURI.normalize('x://h/p?a=%2F'), 'x://h/p?a=%2F', 'keeps reserved encoded in query')
+  // raw characters that are not allowed are percent-encoded
+  t.equal(fastURI.normalize('x://h/p?a b'), 'x://h/p?a%20b', 'encodes a raw space in query')
+  t.equal(fastURI.normalize('x://h/p?café'), 'x://h/p?caf%C3%A9', 'encodes raw non-ASCII in query')
+  // `?` is allowed unencoded in a query
+  t.equal(fastURI.normalize('x://h/p?a?b'), 'x://h/p?a?b', 'keeps `?` raw in query')
+
+  t.end()
+})
+
+test('fragment percent-encoding is normalized without decoding reserved characters', (t) => {
+  // reserved characters must NOT be decoded — `%2F` is not `/`
+  t.equal(fastURI.normalize('x://h/p#a%2Fb%2A'), 'x://h/p#a%2Fb%2A', 'keeps reserved encoded in fragment')
+  // hex is uppercased and unreserved is decoded
+  t.equal(fastURI.normalize('x://h/p#a%2a%7e'), 'x://h/p#a%2A~', 'uppercases hex and decodes unreserved in fragment')
+  // raw characters are still encoded
+  t.equal(fastURI.normalize('x://h/p#a b'), 'x://h/p#a%20b', 'encodes a raw space in fragment')
+  // `?` and `/` are allowed unencoded in a fragment
+  t.equal(fastURI.normalize('x://h/p#f?x/y'), 'x://h/p#f?x/y', 'keeps `?` and `/` raw in fragment')
+
+  t.end()
+})

package/node_modules/fast-uri/test/scheme-normalization.test.js

@@ -0,0 +1,16 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+test('scheme is normalized to lowercase (RFC 3986 §6.2.2.1)', (t) => {
+  // parse lowercases the scheme, consistent with how it already lowercases the host
+  t.equal(fastURI.parse('HTTP://EXAMPLE.com/Path').scheme, 'http', 'parse lowercases an uppercase scheme')
+  t.equal(fastURI.parse('HtTpS://example.com').scheme, 'https', 'parse lowercases a mixed-case scheme')
+
+  // normalize emits a lowercase scheme (matches the already-lowercased host)
+  t.equal(fastURI.normalize('HTTP://EXAMPLE.com/p'), 'http://example.com/p', 'normalize lowercases the scheme')
+  t.equal(fastURI.normalize('HtTp://Example.COM/'), 'http://example.com/', 'normalize lowercases a mixed-case scheme')
+
+  t.end()
+})

package/node_modules/fast-uri/test/security.test.js

@@ -131,3 +131,229 @@ test('normalize does not double-decode %2540 into a live @', (t) => {
   t.plan(1)
   t.notEqual(parsed.host, 'trusted.com@evil.com', 'http://trusted.com%2540evil.com/')
 })
+
+test('parse canonicalises IDN / Unicode hosts to their ASCII form', (t) => {
+  const cases = [
+    {
+      input: 'http://127。0。0。1/',
+      expectedHost: '127.0.0.1',
+      description: 'full-width ideographic stops as octet separators'
+    },
+    {
+      input: 'http://ｅxample.com/',
+      expectedHost: 'example.com',
+      description: 'fullwidth e as first letter'
+    },
+    {
+      input: 'http://納豆.example.org/',
+      expectedHost: 'xn--99zt52a.example.org',
+      description: 'CJK label requiring punycode'
+    }
+  ]
+
+  t.plan(cases.length * 2)
+
+  cases.forEach(({ input, expectedHost, description }) => {
+    const parsed = fastURI.parse(input)
+    t.notOk(parsed.error, `parse should not set error: ${description}`)
+    t.equal(parsed.host, expectedHost, `host canonicalised to ASCII: ${description}`)
+  })
+})
+
+test('parse rejects a literal backslash in the authority as malformed (RFC 3986)', (t) => {
+  // Regression for the host-confusion bypass: a literal "\" is invalid RFC 3986
+  // syntax and must be flagged malformed, not silently rewritten. Otherwise "\"
+  // acts as a host delimiter here while Node's native URL parses a different
+  // host, defeating a host-based SSRF/redirect/origin allowlist.
+  const cases = [
+    'http://evil.com\\@allowed.com',
+    'https://169.254.169.254\\@trusted.example.com',
+    'http://127.0.0.1\\@public.example.com',
+    'https://attacker.com\\@api.internal',
+    'http://a\\@b',
+    'ws://evil.com\\@allowed.com/chat',
+    'wss://evil.com\\@allowed.com/chat',
+    'http://evil.com\\%40allowed.com',
+    '//evil.com\\@allowed.com'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(
+      fastURI.parse(input).error,
+      'URI authority must not contain a literal backslash.',
+      input
+    )
+  })
+})
+
+test('normalize does not canonicalize a literal-backslash URI into a different valid URL', (t) => {
+  const cases = [
+    'http://evil.com\\@allowed.com',
+    'https://attacker.com\\@api.internal'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(fastURI.normalize(input), input, input)
+  })
+})
+
+test('parse leaves percent-encoded %5C untouched as encoded data (not rejected)', (t) => {
+  // Only the literal "\" byte is rejected; %5C stays valid encoded data and
+  // does not diverge from the native URL parser, so it must not be flagged.
+  const input = 'http://evil.com%5C@allowed.com'
+  const parsed = fastURI.parse(input)
+
+  t.plan(2)
+  t.notOk(parsed.error, '%5C is valid encoded data, not malformed')
+  t.equal(parsed.host, new URL(input).hostname, '%5C host matches native URL (no divergence)')
+})
+
+test('parse does not reject a literal backslash in the query or fragment', (t) => {
+  // The rejection is scoped to the authority/path (the host-confusion surface);
+  // a backslash after "?"/"#" is normalized as encoded data as before.
+  const parsed = fastURI.parse('http://host.example.com/?x=\\y#z\\w')
+
+  t.plan(2)
+  t.notOk(parsed.error, 'backslash in query/fragment does not mark the URI malformed')
+  t.equal(parsed.host, 'host.example.com', 'host parsed normally')
+})
+
+test('parse rejects a malformed authority introducer (\\\\, /\\, \\/) in place of //', (t) => {
+  // Regression: "\\", "/\\", "\\/" after the scheme colon are not valid authority
+  // introducers. Node's URL treats "\\" as interchangeable with "/" on special
+  // schemes, so "http:\\\\evil.com/path" would be parsed as host "evil.com" by
+  // Node, but fast-uri must reject it as malformed to prevent SSRF/redirect bypass.
+  const cases = [
+    'http:\\\\evil.com/path',
+    'http:/\\evil.com/path',
+    'http:\\/evil.com/path',
+    'ws:\\\\evil.com/chat',
+    'wss:\\\\evil.com/chat',
+    'ftp:\\\\evil.com/',
+    '\\\\evil.com/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(
+      fastURI.parse(input).error,
+      'URI authority must not contain a literal backslash.',
+      input
+    )
+  })
+})
+
+test('normalize does not canonicalize a malformed-authority-introducer URI', (t) => {
+  const cases = [
+    'http:\\\\evil.com/path',
+    'http:/\\evil.com/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(fastURI.normalize(input), input, input)
+  })
+})
+
+test('equal returns false for malformed-authority-introducer URIs', (t) => {
+  const pairs = [
+    ['http:\\\\evil.com/path', 'http://evil.com/path'],
+    ['http:/\\evil.com/path', 'http://evil.com/path']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([left, right]) => {
+    t.equal(fastURI.equal(left, right), false, `${left} != ${right}`)
+  })
+})
+
+test('resolve throws on malformed authority introducer', (t) => {
+  // resolve() returns a plain string with no error field, so the only safe
+  // behavior is to throw when either component has a malformed authority.
+  const pairs = [
+    ['https://allowed.com/', '\\\\evil.com/path'],
+    ['\\\\evil.com/path', 'https://allowed.com/'],
+    ['https://allowed.com/', 'http:/\\evil.com/path'],
+    ['https://allowed.com/', 'http:\\/evil.com/path']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([base, rel]) => {
+    t.throws(
+      () => fastURI.resolve(base, rel),
+      /URI authority must not contain a literal backslash/,
+      `${base} + ${rel}`
+    )
+  })
+})
+
+test('parse rejects a whitespace-split authority introducer (TAB, LF, CR)', (t) => {
+  // The WHATWG URL parser removes TAB (U+0009), LF (U+000A) and CR (U+000D) from
+  // the input before parsing, so a stripped character wedged into the introducer
+  // ("/<TAB>\\", "/<TAB>/", or a leading "<TAB>//") reaches an authority in Node
+  // while fast-uri would otherwise fold it into the path. These must be rejected
+  // like the adjacent "\\", "/\\", "\\/" forms.
+  const cases = [
+    { input: '/\t\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
+    { input: '/\n\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '/\r\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '\t//evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
+    { input: '\t/\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: 'https:/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' }
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach(({ input, expectedError }) => {
+    t.equal(fastURI.parse(input).error, expectedError, JSON.stringify(input))
+  })
+})
+
+test('resolve throws on a whitespace-split authority introducer', (t) => {
+  const pairs = [
+    ['https://allowed.com/', '/\t\\evil.com/path'],
+    ['https://allowed.com/', '/\t/evil.com/path'],
+    ['https://allowed.com/', '/\n\\evil.com/path'],
+    ['/\t/evil.com/path', 'https://allowed.com/']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([base, rel]) => {
+    t.throws(
+      () => fastURI.resolve(base, rel),
+      /URI authority (must not contain a literal backslash|introducer must not contain whitespace)/,
+      `${JSON.stringify(base)} + ${JSON.stringify(rel)}`
+    )
+  })
+})
+
+test('parse does not reject valid authority introducer patterns', (t) => {
+  // No false positives: "//" introducer and scheme-less "//" must be valid.
+  const cases = [
+    'http://good.com/',
+    'https://good.com/',
+    'ws://good.com/chat',
+    'wss://good.com/chat',
+    'ftp://good.com/',
+    '//good.com/path',
+    '/absolute/path',
+    'relative/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    const parsed = fastURI.parse(input)
+    t.notOk(parsed.error, input)
+  })
+})

package/node_modules/fast-uri/test/uri-js.test.js

@@ -8,7 +8,7 @@ const fastURI = require('..')
  *
  * @fileoverview An RFC 3986 compliant, scheme extendable URI parsing/normalizing/resolving/serializing library for JavaScript.
  * @author <a href="mailto:gary.court@gmail.com">Gary Court</a>
- * @see http://github.com/garycourt/uri-js
+ * @see https://github.com/garycourt/uri-js
  */
 
 /**

package/node_modules/fast-uri/test/util.test.js

@@ -29,6 +29,15 @@ test('removeDotSegments', (t) => {
   // https://github.com/fastify/fast-uri/issues/139
   testCases.push(['WS:/WS://1305G130505:1&%0D:1&C(XXXXX*)))))))XXX130505:UUVUaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa$aaaaaaaaaaaa13a',
     'WS:/WS://1305G130505:1&%0D:1&C(XXXXX*)))))))XXX130505:UUVUaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa$aaaaaaaaaaaa13a'])
+  // trailing empty segments must be preserved: RFC 3986 5.2.4 only removes
+  // complete "." / ".." segments, never an empty segment
+  testCases.push(['//', '//'])
+  testCases.push(['/foo//', '/foo//'])
+  testCases.push(['/a/b//', '/a/b//'])
+  testCases.push(['/x//y//z', '/x//y//z'])
+  // "." / ".." segments still collapse
+  testCases.push(['/a/b/c/./../../g', '/a/g'])
+  testCases.push(['/.', '/'])
 
   t.plan(testCases.length)
 

package/node_modules/fast-uri/tsconfig.json

@@ -1,9 +1,10 @@
 {
-    "compilerOptions": {
-        "allowJs": true,
-        "checkJs": true,
-        "strict": true,
-        "noImplicitAny": true,
-        "target": "es2015"
-    }
+  "compilerOptions": {
+    "allowJs": true,
+    "checkJs": true,
+    "strict": true,
+    "noImplicitAny": true,
+    "target": "es2022",
+    "noEmit": true
+  }
 }

package/node_modules/fast-uri/types/index.d.ts

@@ -28,15 +28,6 @@ declare namespace fastUri {
     nid?: string;
   }
 
-  /**
-   * @deprecated Use Options instead
-   */
-  export type options = Options
-  /**
-   * @deprecated Use URIComponent instead
-   */
-  export type URIComponents = URIComponent
-
   export function normalize (uri: string, opts?: Options): string
   export function normalize (uri: URIComponent, opts?: Options): URIComponent
   export function normalize (uri: any, opts?: Options): any