@pnpm/exe 11.0.0-alpha.9 → 11.0.0-beta.1

package/dist/node_modules/minimatch/dist/esm/index.js

@@ -193,11 +193,13 @@ export class Minimatch {
     isWindows;
     platform;
     windowsNoMagicRoot;
+    maxGlobstarRecursion;
     regexp;
     constructor(pattern, options = {}) {
         assertValidPattern(pattern);
         options = options || {};
         this.options = options;
+        this.maxGlobstarRecursion = options.maxGlobstarRecursion ?? 200;
         this.pattern = pattern;
         this.platform = options.platform || defaultPlatform;
         this.isWindows = this.platform === 'win32';
@@ -602,7 +604,8 @@ export class Minimatch {
     // out of pattern, then that's fine, as long as all
     // the parts match.
     matchOne(file, pattern, partial = false) {
-        const options = this.options;
+        let fileStartIndex = 0;
+        let patternStartIndex = 0;
         // UNC paths like //?/X:/... can match X:/... and vice versa
         // Drive letters in absolute drive or unc paths are always compared
         // case-insensitively.
@@ -631,14 +634,11 @@ export class Minimatch {
                     file[fdi],
                     pattern[pdi],
                 ];
+                // start matching at the drive letter index of each
                 if (fd.toLowerCase() === pd.toLowerCase()) {
                     pattern[pdi] = fd;
-                    if (pdi > fdi) {
-                        pattern = pattern.slice(pdi);
-                    }
-                    else if (fdi > pdi) {
-                        file = file.slice(fdi);
-                    }
+                    patternStartIndex = pdi;
+                    fileStartIndex = fdi;
                 }
             }
         }
@@ -648,99 +648,185 @@ export class Minimatch {
         if (optimizationLevel >= 2) {
             file = this.levelTwoFileOptimize(file);
         }
-        this.debug('matchOne', this, { file, pattern });
-        this.debug('matchOne', file.length, pattern.length);
-        for (var fi = 0, pi = 0, fl = file.length, pl = pattern.length; fi < fl && pi < pl; fi++, pi++) {
+        if (pattern.includes(GLOBSTAR)) {
+            return this.#matchGlobstar(file, pattern, partial, fileStartIndex, patternStartIndex);
+        }
+        return this.#matchOne(file, pattern, partial, fileStartIndex, patternStartIndex);
+    }
+    #matchGlobstar(file, pattern, partial, fileIndex, patternIndex) {
+        // split the pattern into head, tail, and middle of ** delimited parts
+        const firstgs = pattern.indexOf(GLOBSTAR, patternIndex);
+        const lastgs = pattern.lastIndexOf(GLOBSTAR);
+        // split the pattern up into globstar-delimited sections
+        // the tail has to be at the end, and the others just have
+        // to be found in order from the head.
+        const [head, body, tail] = partial ? [
+            pattern.slice(patternIndex, firstgs),
+            pattern.slice(firstgs + 1),
+            [],
+        ] : [
+            pattern.slice(patternIndex, firstgs),
+            pattern.slice(firstgs + 1, lastgs),
+            pattern.slice(lastgs + 1),
+        ];
+        // check the head, from the current file/pattern index.
+        if (head.length) {
+            const fileHead = file.slice(fileIndex, fileIndex + head.length);
+            if (!this.#matchOne(fileHead, head, partial, 0, 0)) {
+                return false;
+            }
+            fileIndex += head.length;
+            patternIndex += head.length;
+        }
+        // now we know the head matches!
+        // if the last portion is not empty, it MUST match the end
+        // check the tail
+        let fileTailMatch = 0;
+        if (tail.length) {
+            // if head + tail > file, then we cannot possibly match
+            if (tail.length + fileIndex > file.length)
+                return false;
+            // try to match the tail
+            let tailStart = file.length - tail.length;
+            if (this.#matchOne(file, tail, partial, tailStart, 0)) {
+                fileTailMatch = tail.length;
+            }
+            else {
+                // affordance for stuff like a/**/* matching a/b/
+                // if the last file portion is '', and there's more to the pattern
+                // then try without the '' bit.
+                if (file[file.length - 1] !== '' ||
+                    fileIndex + tail.length === file.length) {
+                    return false;
+                }
+                tailStart--;
+                if (!this.#matchOne(file, tail, partial, tailStart, 0)) {
+                    return false;
+                }
+                fileTailMatch = tail.length + 1;
+            }
+        }
+        // now we know the tail matches!
+        // the middle is zero or more portions wrapped in **, possibly
+        // containing more ** sections.
+        // so a/**/b/**/c/**/d has become **/b/**/c/**
+        // if it's empty, it means a/**/b, just verify we have no bad dots
+        // if there's no tail, so it ends on /**, then we must have *something*
+        // after the head, or it's not a matc
+        if (!body.length) {
+            let sawSome = !!fileTailMatch;
+            for (let i = fileIndex; i < file.length - fileTailMatch; i++) {
+                const f = String(file[i]);
+                sawSome = true;
+                if (f === '.' ||
+                    f === '..' ||
+                    (!this.options.dot && f.startsWith('.'))) {
+                    return false;
+                }
+            }
+            // in partial mode, we just need to get past all file parts
+            return partial || sawSome;
+        }
+        // now we know that there's one or more body sections, which can
+        // be matched anywhere from the 0 index (because the head was pruned)
+        // through to the length-fileTailMatch index.
+        // split the body up into sections, and note the minimum index it can
+        // be found at (start with the length of all previous segments)
+        // [section, before, after]
+        const bodySegments = [[[], 0]];
+        let currentBody = bodySegments[0];
+        let nonGsParts = 0;
+        const nonGsPartsSums = [0];
+        for (const b of body) {
+            if (b === GLOBSTAR) {
+                nonGsPartsSums.push(nonGsParts);
+                currentBody = [[], 0];
+                bodySegments.push(currentBody);
+            }
+            else {
+                currentBody[0].push(b);
+                nonGsParts++;
+            }
+        }
+        let i = bodySegments.length - 1;
+        const fileLength = file.length - fileTailMatch;
+        for (const b of bodySegments) {
+            b[1] = fileLength - (nonGsPartsSums[i--] + b[0].length);
+        }
+        return !!this.#matchGlobStarBodySections(file, bodySegments, fileIndex, 0, partial, 0, !!fileTailMatch);
+    }
+    // return false for "nope, not matching"
+    // return null for "not matching, cannot keep trying"
+    #matchGlobStarBodySections(file, 
+    // pattern section, last possible position for it
+    bodySegments, fileIndex, bodyIndex, partial, globStarDepth, sawTail) {
+        // take the first body segment, and walk from fileIndex to its "after"
+        // value at the end
+        // If it doesn't match at that position, we increment, until we hit
+        // that final possible position, and give up.
+        // If it does match, then advance and try to rest.
+        // If any of them fail we keep walking forward.
+        // this is still a bit recursively painful, but it's more constrained
+        // than previous implementations, because we never test something that
+        // can't possibly be a valid matching condition.
+        const bs = bodySegments[bodyIndex];
+        if (!bs) {
+            // just make sure that there's no bad dots
+            for (let i = fileIndex; i < file.length; i++) {
+                sawTail = true;
+                const f = file[i];
+                if (f === '.' ||
+                    f === '..' ||
+                    (!this.options.dot && f.startsWith('.'))) {
+                    return false;
+                }
+            }
+            return sawTail;
+        }
+        // have a non-globstar body section to test
+        const [body, after] = bs;
+        while (fileIndex <= after) {
+            const m = this.#matchOne(file.slice(0, fileIndex + body.length), body, partial, fileIndex, 0);
+            // if limit exceeded, no match. intentional false negative,
+            // acceptable break in correctness for security.
+            if (m && globStarDepth < this.maxGlobstarRecursion) {
+                // match! see if the rest match. if so, we're done!
+                const sub = this.#matchGlobStarBodySections(file, bodySegments, fileIndex + body.length, bodyIndex + 1, partial, globStarDepth + 1, sawTail);
+                if (sub !== false) {
+                    return sub;
+                }
+            }
+            const f = file[fileIndex];
+            if (f === '.' ||
+                f === '..' ||
+                (!this.options.dot && f.startsWith('.'))) {
+                return false;
+            }
+            fileIndex++;
+        }
+        // walked off. no point continuing
+        return partial || null;
+    }
+    #matchOne(file, pattern, partial, fileIndex, patternIndex) {
+        let fi;
+        let pi;
+        let pl;
+        let fl;
+        for (fi = fileIndex,
+            pi = patternIndex,
+            fl = file.length,
+            pl = pattern.length; fi < fl && pi < pl; fi++, pi++) {
             this.debug('matchOne loop');
-            var p = pattern[pi];
-            var f = file[fi];
+            let p = pattern[pi];
+            let f = file[fi];
             this.debug(pattern, p, f);
             // should be impossible.
             // some invalid regexp stuff in the set.
             /* c8 ignore start */
-            if (p === false) {
+            if (p === false || p === GLOBSTAR) {
                 return false;
             }
             /* c8 ignore stop */
-            if (p === GLOBSTAR) {
-                this.debug('GLOBSTAR', [pattern, p, f]);
-                // "**"
-                // a/**/b/**/c would match the following:
-                // a/b/x/y/z/c
-                // a/x/y/z/b/c
-                // a/b/x/b/x/c
-                // a/b/c
-                // To do this, take the rest of the pattern after
-                // the **, and see if it would match the file remainder.
-                // If so, return success.
-                // If not, the ** "swallows" a segment, and try again.
-                // This is recursively awful.
-                //
-                // a/**/b/**/c matching a/b/x/y/z/c
-                // - a matches a
-                // - doublestar
-                //   - matchOne(b/x/y/z/c, b/**/c)
-                //     - b matches b
-                //     - doublestar
-                //       - matchOne(x/y/z/c, c) -> no
-                //       - matchOne(y/z/c, c) -> no
-                //       - matchOne(z/c, c) -> no
-                //       - matchOne(c, c) yes, hit
-                var fr = fi;
-                var pr = pi + 1;
-                if (pr === pl) {
-                    this.debug('** at the end');
-                    // a ** at the end will just swallow the rest.
-                    // We have found a match.
-                    // however, it will not swallow /.x, unless
-                    // options.dot is set.
-                    // . and .. are *never* matched by **, for explosively
-                    // exponential reasons.
-                    for (; fi < fl; fi++) {
-                        if (file[fi] === '.' ||
-                            file[fi] === '..' ||
-                            (!options.dot && file[fi].charAt(0) === '.'))
-                            return false;
-                    }
-                    return true;
-                }
-                // ok, let's see if we can swallow whatever we can.
-                while (fr < fl) {
-                    var swallowee = file[fr];
-                    this.debug('\nglobstar while', file, fr, pattern, pr, swallowee);
-                    // XXX remove this slice.  Just pass the start index.
-                    if (this.matchOne(file.slice(fr), pattern.slice(pr), partial)) {
-                        this.debug('globstar found match!', fr, fl, swallowee);
-                        // found a match.
-                        return true;
-                    }
-                    else {
-                        // can't swallow "." or ".." ever.
-                        // can only swallow ".foo" when explicitly asked.
-                        if (swallowee === '.' ||
-                            swallowee === '..' ||
-                            (!options.dot && swallowee.charAt(0) === '.')) {
-                            this.debug('dot detected!', file, fr, pattern, pr);
-                            break;
-                        }
-                        // ** swallows a segment, and continue.
-                        this.debug('globstar swallow a segment, and continue');
-                        fr++;
-                    }
-                }
-                // no match was found.
-                // However, in partial mode, we can't say this is necessarily over.
-                /* c8 ignore start */
-                if (partial) {
-                    // ran out of file
-                    this.debug('\n>>> no match, partial?', file, fr, pattern, pr);
-                    if (fr === fl) {
-                        return true;
-                    }
-                }
-                /* c8 ignore stop */
-                return false;
-            }
             // something other than **
             // non-magic patterns just have to match exactly
             // patterns with magic have been turned into regexps.

package/dist/node_modules/minimatch/package.json

@@ -2,7 +2,7 @@
   "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
   "name": "minimatch",
   "description": "a glob matcher in javascript",
-  "version": "10.2.1",
+  "version": "10.2.4",
   "repository": {
     "type": "git",
     "url": "git@github.com:isaacs/minimatch"
@@ -39,13 +39,13 @@
     "typedoc": "typedoc --tsconfig .tshy/esm.json ./src/*.ts"
   },
   "engines": {
-    "node": "20 || >=22"
+    "node": "18 || 20 || >=22"
   },
   "devDependencies": {
-    "@types/node": "^24.0.0",
+    "@types/node": "^25.3.0",
     "mkdirp": "^3.0.1",
     "prettier": "^3.6.2",
-    "tap": "^21.1.0",
+    "tap": "^21.6.2",
     "tshy": "^3.0.2",
     "typedoc": "^0.28.5"
   },

package/dist/node_modules/minipass/dist/commonjs/index.js

@@ -22,7 +22,11 @@ const isStream = (s) => !!s &&
     (s instanceof Minipass ||
         s instanceof node_stream_1.default ||
         (0, exports.isReadable)(s) ||
-        (0, exports.isWritable)(s));
+        (0, exports.isWritable)(s))
+/**
+ * Return true if the argument is a valid {@link Minipass.Readable}
+ */
+;
 exports.isStream = isStream;
 /**
  * Return true if the argument is a valid {@link Minipass.Readable}
@@ -32,7 +36,11 @@ const isReadable = (s) => !!s &&
     s instanceof node_events_1.EventEmitter &&
     typeof s.pipe === 'function' &&
     // node core Writable streams have a pipe() method, but it throws
-    s.pipe !== node_stream_1.default.Writable.prototype.pipe;
+    s.pipe !== node_stream_1.default.Writable.prototype.pipe
+/**
+ * Return true if the argument is a valid {@link Minipass.Writable}
+ */
+;
 exports.isReadable = isReadable;
 /**
  * Return true if the argument is a valid {@link Minipass.Writable}
@@ -129,7 +137,7 @@ class PipeProxyErrors extends Pipe {
     }
     constructor(src, dest, opts) {
         super(src, dest, opts);
-        this.proxyErrors = er => dest.emit('error', er);
+        this.proxyErrors = (er) => this.dest.emit('error', er);
         src.on('error', this.proxyErrors);
     }
 }
@@ -939,6 +947,7 @@ class Minipass extends node_events_1.EventEmitter {
             [Symbol.asyncIterator]() {
                 return this;
             },
+            [Symbol.asyncDispose]: async () => { },
         };
     }
     /**
@@ -976,6 +985,7 @@ class Minipass extends node_events_1.EventEmitter {
             [Symbol.iterator]() {
                 return this;
             },
+            [Symbol.dispose]: () => { },
         };
     }
     /**

package/dist/node_modules/minipass/dist/esm/index.js

@@ -120,7 +120,7 @@ class PipeProxyErrors extends Pipe {
     }
     constructor(src, dest, opts) {
         super(src, dest, opts);
-        this.proxyErrors = er => dest.emit('error', er);
+        this.proxyErrors = (er) => this.dest.emit('error', er);
         src.on('error', this.proxyErrors);
     }
 }
@@ -930,6 +930,7 @@ export class Minipass extends EventEmitter {
             [Symbol.asyncIterator]() {
                 return this;
             },
+            [Symbol.asyncDispose]: async () => { },
         };
     }
     /**
@@ -967,6 +968,7 @@ export class Minipass extends EventEmitter {
             [Symbol.iterator]() {
                 return this;
             },
+            [Symbol.dispose]: () => { },
         };
     }
     /**

package/dist/node_modules/minipass/package.json

@@ -1,13 +1,14 @@
 {
   "name": "minipass",
-  "version": "7.1.2",
+  "version": "7.1.3",
   "description": "minimal implementation of a PassThrough stream",
   "main": "./dist/commonjs/index.js",
   "types": "./dist/commonjs/index.d.ts",
+  "module": "./dist/esm/index.js",
   "type": "module",
   "tshy": {
     "selfLink": false,
-    "main": true,
+    "compiler": "tsgo",
     "exports": {
       "./package.json": "./package.json",
       ".": "./src/index.ts"
@@ -54,14 +55,14 @@
   },
   "devDependencies": {
     "@types/end-of-stream": "^1.4.2",
-    "@types/node": "^20.1.2",
+    "@types/node": "^25.2.3",
     "end-of-stream": "^1.4.0",
     "node-abort-controller": "^3.1.1",
-    "prettier": "^2.6.2",
-    "tap": "^19.0.0",
+    "prettier": "^3.8.1",
+    "tap": "^21.6.1",
     "through2": "^2.0.3",
-    "tshy": "^1.14.0",
-    "typedoc": "^0.25.1"
+    "tshy": "^3.3.2",
+    "typedoc": "^0.28.17"
   },
   "repository": "https://github.com/isaacs/minipass",
   "keywords": [
@@ -69,14 +70,8 @@
     "stream"
   ],
   "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",
-  "license": "ISC",
+  "license": "BlueOak-1.0.0",
   "engines": {
     "node": ">=16 || 14 >=14.17"
-  },
-  "tap": {
-    "typecheck": true,
-    "include": [
-      "test/*.ts"
-    ]
   }
 }

package/dist/node_modules/minipass-fetch/lib/body.js

@@ -1,15 +1,15 @@
 'use strict'
 const { Minipass } = require('minipass')
-const MinipassSized = require('minipass-sized')
+const { MinipassSized } = require('minipass-sized')
 
 const Blob = require('./blob.js')
 const { BUFFER } = Blob
 const FetchError = require('./fetch-error.js')
 
-// optional dependency on 'encoding'
-let convert
+// optional dependency on 'iconv-lite'
+let decode
 try {
-  convert = require('encoding').convert
+  decode = require('iconv-lite').decode
 } catch (e) {
   // defer error until textConverted is called
 }
@@ -92,6 +92,10 @@ class Body {
   }
 
   textConverted () {
+    /* istanbul ignore if */
+    if (typeof decode !== 'function') {
+      throw new Error('The package `iconv-lite` must be installed to use the textConverted() function')
+    }
     return this[CONSUME_BODY]().then(buf => convertBody(buf, this.headers))
   }
 
@@ -285,11 +289,6 @@ const isBlob = obj =>
   /^(Blob|File)$/.test(obj[Symbol.toStringTag])
 
 const convertBody = (buffer, headers) => {
-  /* istanbul ignore if */
-  if (typeof convert !== 'function') {
-    throw new Error('The package `encoding` must be installed to use the textConverted() function')
-  }
-
   const ct = headers && headers.get('content-type')
   let charset = 'utf-8'
   let res
@@ -339,12 +338,23 @@ const convertBody = (buffer, headers) => {
     }
   }
 
-  // turn raw buffers into a single utf-8 buffer
-  return convert(
-    buffer,
-    'UTF-8',
-    charset
-  ).toString()
+  if (charset === 'UTF-8') {
+    return buffer.toString('UTF-8')
+  }
+
+  charset = charset.toString().trim()
+    .replace(/^latin[-_]?(\d+)$/i, 'ISO-8859-$1')
+    .replace(/^win(?:dows)?[-_]?(\d+)$/i, 'WINDOWS-$1')
+    .replace(/^utf[-_]?(\d+)$/i, 'UTF-$1')
+    .replace(/^ks_c_5601-1987$/i, 'CP949')
+    .replace(/^us[-_]?ascii$/i, 'ASCII')
+    .toUpperCase()
+  try {
+    return decode(buffer, charset).toString()
+  } catch {
+    /* istanbul ignore next */
+    return buffer.toString('UTF-8')
+  }
 }
 
 module.exports = Body

package/dist/node_modules/minipass-fetch/package.json

@@ -1,6 +1,6 @@
 {
   "name": "minipass-fetch",
-  "version": "4.0.1",
+  "version": "5.0.2",
   "description": "An implementation of window.fetch in Node.js using Minipass streams",
   "license": "MIT",
   "main": "lib/index.js",
@@ -25,12 +25,12 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^5.0.0",
-    "@npmcli/template-oss": "4.23.3",
+    "@npmcli/template-oss": "4.27.1",
     "@ungap/url-search-params": "^0.2.2",
     "abort-controller": "^3.0.0",
     "abortcontroller-polyfill": "~1.7.3",
-    "encoding": "^0.1.13",
     "form-data": "^4.0.0",
+    "iconv-lite": "^0.7.2",
     "nock": "^13.2.4",
     "parted": "^0.1.1",
     "string-to-arraybuffer": "^1.0.2",
@@ -38,11 +38,11 @@
   },
   "dependencies": {
     "minipass": "^7.0.3",
-    "minipass-sized": "^1.0.3",
+    "minipass-sized": "^2.0.0",
     "minizlib": "^3.0.1"
   },
   "optionalDependencies": {
-    "encoding": "^0.1.13"
+    "iconv-lite": "^0.7.2"
   },
   "repository": {
     "type": "git",
@@ -59,12 +59,12 @@
     "lib/"
   ],
   "engines": {
-    "node": "^18.17.0 || >=20.5.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "author": "GitHub Inc.",
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.23.3",
+    "version": "4.27.1",
     "publish": "true"
   }
 }

package/dist/node_modules/minipass-sized/dist/commonjs/index.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MinipassSized = exports.SizeError = void 0;
+const minipass_1 = require("minipass");
+const isBufferEncoding = (enc) => typeof enc === 'string';
+class SizeError extends Error {
+    expect;
+    found;
+    code = 'EBADSIZE';
+    constructor(found, expect, from) {
+        super(`Bad data size: expected ${expect} bytes, but got ${found}`);
+        this.expect = expect;
+        this.found = found;
+        Error.captureStackTrace(this, from ?? this.constructor);
+    }
+    get name() {
+        return 'SizeError';
+    }
+}
+exports.SizeError = SizeError;
+class MinipassSized extends minipass_1.Minipass {
+    found = 0;
+    expect;
+    constructor(options) {
+        const size = options?.size;
+        if (typeof size !== 'number' ||
+            size > Number.MAX_SAFE_INTEGER ||
+            isNaN(size) ||
+            size < 0 ||
+            !isFinite(size) ||
+            size !== Math.floor(size)) {
+            throw new Error('invalid expected size: ' + size);
+        }
+        //@ts-ignore
+        super(options);
+        if (options.objectMode) {
+            throw new TypeError(`${this.constructor.name} streams only work with string and buffer data`);
+        }
+        this.expect = size;
+    }
+    write(chunk, encoding, cb) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk
+            : typeof chunk === 'string' ?
+                Buffer.from(chunk, isBufferEncoding(encoding) ? encoding : 'utf8')
+                : chunk;
+        if (typeof encoding === 'function') {
+            cb = encoding;
+            encoding = null;
+        }
+        if (!Buffer.isBuffer(buffer)) {
+            this.emit('error', new TypeError(`${this.constructor.name} streams only work with string and buffer data`));
+            return false;
+        }
+        this.found += buffer.length;
+        if (this.found > this.expect)
+            this.emit('error', new SizeError(this.found, this.expect));
+        return super.write(chunk, encoding, cb);
+    }
+    emit(ev, ...args) {
+        if (ev === 'end') {
+            if (this.found !== this.expect) {
+                this.emit('error', new SizeError(this.found, this.expect, this.emit));
+            }
+        }
+        return super.emit(ev, ...args);
+    }
+}
+exports.MinipassSized = MinipassSized;
+//# sourceMappingURL=index.js.map