@openclaw/slack 2026.7.2-beta.7 → 2026.7.34

package/node_modules/@slack/bolt/node_modules/qs/lib/utils.js

@@ -2,7 +2,6 @@
 
 var formats = require('./formats');
 var getSideChannel = require('side-channel');
-var defineProperty = require('es-define-property');
 
 var has = Object.prototype.hasOwnProperty;
 var isArray = Array.isArray;
@@ -67,19 +66,6 @@ var arrayToObject = function arrayToObject(source, options) {
     return obj;
 };
 
-var setProperty = function setProperty(obj, key, value) {
-    if (key === '__proto__' && defineProperty) {
-        defineProperty(obj, key, {
-            configurable: true,
-            enumerable: true,
-            value: value,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-};
-
 var merge = function merge(target, source, options) {
     /* eslint no-param-reassign: 0 */
     if (!source) {
@@ -89,10 +75,7 @@ var merge = function merge(target, source, options) {
     if (typeof source !== 'object' && typeof source !== 'function') {
         if (isArray(target)) {
             var nextIndex = target.length;
-            if (options && typeof options.arrayLimit === 'number' && nextIndex >= options.arrayLimit) {
-                if (options.throwOnLimitExceeded) {
-                    throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
-                }
+            if (options && typeof options.arrayLimit === 'number' && nextIndex > options.arrayLimit) {
                 return markOverflow(arrayToObject(target.concat(source), options), nextIndex);
             }
             target[nextIndex] = source;
@@ -132,9 +115,6 @@ var merge = function merge(target, source, options) {
         }
         var combined = [target].concat(source);
         if (options && typeof options.arrayLimit === 'number' && combined.length > options.arrayLimit) {
-            if (options.throwOnLimitExceeded) {
-                throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
-            }
             return markOverflow(arrayToObject(combined, options), combined.length - 1);
         }
         return combined;
@@ -158,12 +138,6 @@ var merge = function merge(target, source, options) {
                 target[i] = item;
             }
         });
-        if (options && typeof options.arrayLimit === 'number' && target.length > options.arrayLimit) {
-            if (options.throwOnLimitExceeded) {
-                throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
-            }
-            return markOverflow(arrayToObject(target, options), target.length - 1);
-        }
         return target;
     }
 
@@ -171,9 +145,9 @@ var merge = function merge(target, source, options) {
         var value = source[key];
 
         if (has.call(acc, key)) {
-            setProperty(acc, key, merge(acc[key], value, options));
+            acc[key] = merge(acc[key], value, options);
         } else {
-            setProperty(acc, key, value);
+            acc[key] = value;
         }
 
         if (isOverflow(source) && !isOverflow(acc)) {
@@ -192,7 +166,7 @@ var merge = function merge(target, source, options) {
 
 var assign = function assignSingleSource(target, source) {
     return Object.keys(source).reduce(function (acc, key) {
-        setProperty(acc, key, source[key]);
+        acc[key] = source[key];
         return acc;
     }, target);
 };
@@ -238,13 +212,6 @@ var encode = function encode(str, defaultEncoder, charset, kind, format) {
     var out = '';
     for (var j = 0; j < string.length; j += limit) {
         var segment = string.length >= limit ? string.slice(j, j + limit) : string;
-        if (j + limit < string.length) {
-            var last = segment.charCodeAt(segment.length - 1);
-            if (last >= 0xD800 && last <= 0xDBFF) {
-                segment = segment.slice(0, -1);
-                j -= 1;
-            }
-        }
         var arr = [];
 
         for (var i = 0; i < segment.length; ++i) {
@@ -298,7 +265,7 @@ var encode = function encode(str, defaultEncoder, charset, kind, format) {
 
 var compact = function compact(value) {
     var queue = [{ obj: { o: value }, prop: 'o' }];
-    var refs = getSideChannel();
+    var refs = [];
 
     for (var i = 0; i < queue.length; ++i) {
         var item = queue[i];
@@ -308,9 +275,9 @@ var compact = function compact(value) {
         for (var j = 0; j < keys.length; ++j) {
             var key = keys[j];
             var val = obj[key];
-            if (typeof val === 'object' && val !== null && !refs.has(val)) {
+            if (typeof val === 'object' && val !== null && refs.indexOf(val) === -1) {
                 queue[queue.length] = { obj: obj, prop: key };
-                refs.set(val, true);
+                refs[refs.length] = val;
             }
         }
     }
@@ -332,12 +299,9 @@ var isBuffer = function isBuffer(obj) {
     return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));
 };
 
-var combine = function combine(a, b, arrayLimit, plainObjects, throwOnLimitExceeded) {
+var combine = function combine(a, b, arrayLimit, plainObjects) {
     // If 'a' is already an overflow object, add to it
     if (isOverflow(a)) {
-        if (throwOnLimitExceeded) {
-            throw new RangeError('Array limit exceeded. Only ' + arrayLimit + ' element' + (arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
-        }
         var newIndex = getMaxIndex(a) + 1;
         a[newIndex] = b;
         setMaxIndex(a, newIndex);
@@ -346,9 +310,6 @@ var combine = function combine(a, b, arrayLimit, plainObjects, throwOnLimitExcee
 
     var result = [].concat(a, b);
     if (result.length > arrayLimit) {
-        if (throwOnLimitExceeded) {
-            throw new RangeError('Array limit exceeded. Only ' + arrayLimit + ' element' + (arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
-        }
         return markOverflow(arrayToObject(result, { plainObjects: plainObjects }), result.length - 1);
     }
     return result;

package/node_modules/@slack/bolt/node_modules/qs/package.json

@@ -2,7 +2,7 @@
     "name": "qs",
     "description": "A querystring parser that supports nesting and arrays, with a depth limit",
     "homepage": "https://github.com/ljharb/qs",
-    "version": "6.15.3",
+    "version": "6.15.2",
     "repository": {
         "type": "git",
         "url": "https://github.com/ljharb/qs.git"
@@ -31,8 +31,7 @@
         "node": ">=0.6"
     },
     "dependencies": {
-        "es-define-property": "^1.0.1",
-        "side-channel": "^1.1.1"
+        "side-channel": "^1.1.0"
     },
     "devDependencies": {
         "@browserify/envify": "^6.0.0",
@@ -43,7 +42,7 @@
         "common-shakeify": "~1.0.0",
         "eclint": "^2.8.1",
         "es-value-fixtures": "^1.7.1",
-        "eslint": "^10.5.0",
+        "eslint": "^9.39.2",
         "evalmd": "^0.0.19",
         "for-each": "^0.3.5",
         "glob": "=10.3.7",
@@ -57,7 +56,7 @@
         "jackspeak": "=2.1.1",
         "jiti": "^0.0.0",
         "mkdirp": "^0.5.5",
-        "mock-property": "^1.1.2",
+        "mock-property": "^1.1.0",
         "module-deps": "^6.2.3",
         "npmignore": "^0.3.5",
         "nyc": "^10.3.2",
@@ -65,7 +64,7 @@
         "qs-iconv": "^1.0.4",
         "safe-publish-latest": "^2.0.0",
         "safer-buffer": "^2.1.2",
-        "tape": "^5.10.2",
+        "tape": "^5.9.0",
         "unassertify": "^3.0.1"
     },
     "scripts": {

package/node_modules/@slack/bolt/node_modules/qs/test/parse.js

@@ -14,12 +14,6 @@ var hasProto = require('has-proto')();
 var qs = require('../');
 var utils = require('../lib/utils');
 
-var characterizeParse = function characterizeParse(st, input, opts, expected, label) {
-    var result;
-    st.doesNotThrow(function () { result = qs.parse(input, opts); }, label + ': does not throw');
-    st.deepEqual(result, expected, label + ': parses to the current lenient output');
-};
-
 test('parse()', function (t) {
     t.test('parses a simple string', function (st) {
         st.deepEqual(qs.parse('0=foo'), { 0: 'foo' });
@@ -318,48 +312,6 @@ test('parse()', function (t) {
         st.end();
     });
 
-    t.test('currently parses unbalanced bracket keys after a parent leniently to literal segments (issue #558)', function (st) {
-        characterizeParse(st, 'a[bc=v', undefined, { a: { '[bc': 'v' } }, 'unclosed group after a parent');
-        characterizeParse(st, 'a[=v', undefined, { a: { '[': 'v' } }, 'bare unclosed bracket after a parent');
-        characterizeParse(st, 'a[b][c=v', undefined, { a: { b: { '[c': 'v' } } }, 'unclosed group after a valid one');
-        characterizeParse(st, 'a[b]c[d=v', undefined, { a: { b: { '[d': 'v' } } }, 'unclosed group after text following a valid one');
-        characterizeParse(st, 'filters[customtags:Env: Prod=v', undefined, { filters: { '[customtags:Env: Prod': 'v' } }, 'the issue #558 reproduction');
-        characterizeParse(st, '][a=v', undefined, { ']': { '[a': 'v' } }, 'stray close bracket before an unclosed group');
-        characterizeParse(st, 'a][b=v', undefined, { 'a]': { '[b': 'v' } }, 'stray close bracket inside the parent');
-        st.end();
-    });
-
-    t.test('currently parses unbalanced bracket keys containing inner brackets leniently (issue #558)', function (st) {
-        characterizeParse(st, 'a[b[c=v', undefined, { a: { '[b[c': 'v' } }, 'unclosed group containing an inner bracket');
-        characterizeParse(st, 'a[b[c]=v', undefined, { a: { '[b[c]': 'v' } }, 'unbalanced group with an inner bracket and one close');
-        characterizeParse(st, 'a[b][c[d=v', undefined, { a: { b: { '[c[d': 'v' } } }, 'unclosed inner-bracket group after a valid one');
-        st.end();
-    });
-
-    t.test('currently parses bracket-prefixed unbalanced keys leniently (issue #558)', function (st) {
-        characterizeParse(st, '[abc=v', undefined, { '[abc': 'v' }, 'key starting with an unclosed bracket');
-        characterizeParse(st, '[[]b=v', undefined, { '[[]b': 'v' }, 'key starting with an unbalanced bracket group');
-        st.end();
-    });
-
-    t.test('lenient unbalanced-bracket handling currently depends on the depth option (issue #558)', function (st) {
-        characterizeParse(st, 'a[b]c[d]e[f=v', { depth: 5 }, { a: { b: { d: { '[f': 'v' } } } }, 'consumes groups up to the depth budget then keeps the unclosed remainder literal');
-        characterizeParse(st, 'a[b]c[d]e[f=v', { depth: 1 }, { a: { b: { '[d]e[f': 'v' } } }, 'a lower depth keeps more of the unclosed remainder literal');
-        characterizeParse(st, 'a[bc=v', { depth: 0 }, { 'a[bc': 'v' }, 'depth 0 keeps the entire key literal');
-        st.end();
-    });
-
-    t.test('currently parses an allowDots key with a trailing unclosed bracket leniently (issue #558)', function (st) {
-        characterizeParse(st, 'a.b[c=v', { allowDots: true }, { a: { b: { '[c': 'v' } } }, 'allowDots expands the dot then keeps the unclosed bracket literal');
-        st.end();
-    });
-
-    t.test('valid and stray-close bracket keys are unaffected by unbalanced-bracket handling', function (st) {
-        characterizeParse(st, 'a]b=v', undefined, { 'a]b': 'v' }, 'stray close bracket with no open bracket stays a flat key');
-        characterizeParse(st, 'a[b]extra=v', undefined, { a: { b: 'v' } }, 'text after a balanced group is ignored');
-        st.end();
-    });
-
     t.test('allows to specify array indices', function (st) {
         st.deepEqual(qs.parse('a[1]=c&a[0]=b&a[2]=d'), { a: ['b', 'c', 'd'] });
         st.deepEqual(qs.parse('a[1]=c&a[0]=b'), { a: ['b', 'c'] });
@@ -774,21 +726,6 @@ test('parse()', function (t) {
         st.end();
     });
 
-    t.test('does not crash on multi-step circular references', function (st) {
-        var a = {};
-        a.b = { c: { d: a } };
-
-        var parsed;
-
-        st.doesNotThrow(function () {
-            parsed = qs.parse({ foo: a });
-        });
-
-        st.equal('foo' in parsed, true, 'parsed has "foo" property');
-        st.equal(parsed.foo.b.c.d, parsed.foo, 'the multi-step cycle is preserved');
-        st.end();
-    });
-
     t.test('does not crash when parsing deep objects', function (st) {
         var parsed;
         var str = 'foo';
@@ -1022,22 +959,6 @@ test('parse()', function (t) {
         st.end();
     });
 
-    t.test('object-valued input with own `__proto__` does not mutate sub-object [[Prototype]]', function (st) {
-        // JSON.parse creates own data `__proto__` properties (via CreateDataProperty),
-        // which would trigger the Object.prototype.__proto__ accessor if merged via `acc[key] = value`.
-        var out = qs.parse({
-            'user[name]': 'alice',
-            user: JSON.parse('{"__proto__":{"isAdmin":true}}')
-        }, { allowPrototypes: false });
-
-        st.equal(out.user.name, 'alice', 'name from bracket key is preserved');
-        st.equal(out.user.isAdmin, undefined, 'attacker-controlled inherited property is not exposed');
-        st.equal(Object.getPrototypeOf(out.user), Object.prototype, 'sub-object [[Prototype]] is unchanged');
-        st.equal(Object.prototype.isAdmin, undefined, 'Object.prototype is not polluted');
-
-        st.end();
-    });
-
     t.test('can return null objects', { skip: !hasProto }, function (st) {
         var expected = {
             __proto__: null,
@@ -1388,157 +1309,6 @@ test('parse()', function (t) {
             sst.end();
         });
 
-        st.test('throws when cumulative comma + duplicate-key combine exceeds arrayLimit', function (sst) {
-            sst['throws'](
-                function () {
-                    qs.parse('a=1,2,3&a=4,5,6', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
-                },
-                new RangeError('Array limit exceeded. Only 5 elements allowed in an array.'),
-                'throws when comma groups within the limit cumulatively exceed it across duplicate keys'
-            );
-
-            sst['throws'](
-                function () {
-                    qs.parse('a=v,v,v,v,v&a=v,v,v,v,v&a=v,v,v,v,v', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
-                },
-                new RangeError('Array limit exceeded. Only 5 elements allowed in an array.'),
-                'throws on a subsequent part once the cumulative array is already over the limit'
-            );
-            sst.end();
-        });
-
-        st.test('throws when plain duplicate keys combine past arrayLimit at the boundary', function (sst) {
-            sst['throws'](
-                function () { qs.parse('a=x&a=y', { arrayLimit: 1, throwOnLimitExceeded: true }); },
-                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
-                'duplicate scalar keys'
-            );
-
-            sst['throws'](
-                function () { qs.parse('a[]=x&a[]=y', { arrayLimit: 1, throwOnLimitExceeded: true }); },
-                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
-                'duplicate bracket keys'
-            );
-            sst.end();
-        });
-
-        st.test('throws when mixed index and key notation merge past arrayLimit', function (sst) {
-            sst['throws'](
-                function () { qs.parse('a=x&a[0]=y', { arrayLimit: 1, throwOnLimitExceeded: true }); },
-                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
-                'scalar then index that overflows on merge'
-            );
-
-            sst['throws'](
-                function () { qs.parse('a[0]=1&a[1]=2&a=3', { arrayLimit: 1, throwOnLimitExceeded: true }); },
-                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
-                'indexed array then scalar that overflows on merge'
-            );
-            sst.end();
-        });
-
-        st.test('enforces arrayLimit on merge at the boundary, consistently with combine', function (sst) {
-            sst['throws'](
-                function () { qs.parse('a[0]=x&a=y', { arrayLimit: 1, throwOnLimitExceeded: true }); },
-                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
-                'a trailing scalar merged into an at-limit array throws'
-            );
-            sst.deepEqual(
-                qs.parse('a[0]=x&a=y', { arrayLimit: 1 }),
-                { a: { 0: 'x', 1: 'y' } },
-                'and converts to an overflow object without throwOnLimitExceeded'
-            );
-
-            sst['throws'](
-                function () { qs.parse('a[0]=x&a[]=y', { arrayLimit: 1, throwOnLimitExceeded: true }); },
-                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
-                'mixed index and bracket notation merged past the limit throws'
-            );
-            sst.deepEqual(
-                qs.parse('a[0]=x&a[]=y', { arrayLimit: 1 }),
-                { a: { 0: 'x', 1: 'y' } },
-                'mixed index and bracket notation converts like duplicate-bracket combine'
-            );
-
-            sst.end();
-        });
-
-        st.test('does not throw when cumulative comma combine stays within arrayLimit', function (sst) {
-            var result = qs.parse('a=1,2,3&a=4', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
-            sst.deepEqual(result, { a: ['1', '2', '3', '4'] }, 'combined array within limit is preserved');
-            sst.end();
-        });
-
-        st.test('silently combines to an overflow object when throwOnLimitExceeded is not set', function (sst) {
-            var result = qs.parse('a=1,2,3&a=4,5,6', { comma: true, arrayLimit: 5 });
-            sst.deepEqual(result, { a: { 0: '1', 1: '2', 2: '3', 3: '4', 4: '5', 5: '6' } }, 'converts to object without throwing');
-            sst.end();
-        });
-
-        st.test('does not throw for comma groups nested under bracket notation, counting each group as one element', function (sst) {
-            var result = qs.parse('a[]=1,2,3&a[]=4,5,6', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
-            sst.deepEqual(result, { a: [['1', '2', '3'], ['4', '5', '6']] }, 'nested comma groups count as one element each');
-            sst.end();
-        });
-
-        st.test('throws before splitting when a single comma value exceeds arrayLimit', function (sst) {
-            sst['throws'](
-                function () {
-                    qs.parse('a=1,2,3,4,5,6', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
-                },
-                new RangeError('Array limit exceeded. Only 5 elements allowed in an array.'),
-                'a flat comma value over the limit throws'
-            );
-
-            sst['throws'](
-                function () {
-                    qs.parse('a=1,2', { comma: true, arrayLimit: 1, throwOnLimitExceeded: true });
-                },
-                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
-                'singular message at arrayLimit 1'
-            );
-
-            sst['throws'](
-                function () {
-                    qs.parse('a[b]=1,2,3,4,5,6', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
-                },
-                new RangeError('Array limit exceeded. Only 5 elements allowed in an array.'),
-                'a non-bracket nested key comma value over the limit throws'
-            );
-            sst.end();
-        });
-
-        st.test('does not throw for a single comma value within arrayLimit', function (sst) {
-            sst.deepEqual(
-                qs.parse('a=1,2,3', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true }),
-                { a: ['1', '2', '3'] },
-                'within the limit'
-            );
-            sst.deepEqual(
-                qs.parse('a=1,2,3,4,5', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true }),
-                { a: ['1', '2', '3', '4', '5'] },
-                'exactly at the limit'
-            );
-            sst.end();
-        });
-
-        st.test('does not throw for a bracketed comma group within arrayLimit', function (sst) {
-            var result = qs.parse('a[]=1,2,3,4,5,6', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
-            sst.deepEqual(result, { a: [['1', '2', '3', '4', '5', '6']] }, 'a bracketed comma group is a single element');
-            sst.end();
-        });
-
-        st.test('throws for a bracketed comma group when arrayLimit is 0', function (sst) {
-            sst['throws'](
-                function () {
-                    qs.parse('a[]=1,2,3', { comma: true, arrayLimit: 0, throwOnLimitExceeded: true });
-                },
-                new RangeError('Array limit exceeded. Only 0 elements allowed in an array.'),
-                'a single bracketed element still exceeds arrayLimit 0'
-            );
-            sst.end();
-        });
-
         st.end();
     });