@pnpm/exe 11.0.0-beta.2 → 11.0.0-beta.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (81) hide show
  1. package/dist/node_modules/@gar/promise-retry/LICENSE +1 -0
  2. package/dist/node_modules/@gar/promise-retry/lib/index.js +43 -9
  3. package/dist/node_modules/@gar/promise-retry/lib/retry.js +109 -0
  4. package/dist/node_modules/@gar/promise-retry/package.json +1 -4
  5. package/dist/node_modules/@npmcli/redact/LICENSE +21 -0
  6. package/dist/node_modules/@npmcli/redact/lib/deep-map.js +71 -0
  7. package/dist/node_modules/@npmcli/redact/lib/error.js +28 -0
  8. package/dist/node_modules/@npmcli/redact/lib/index.js +44 -0
  9. package/dist/node_modules/@npmcli/redact/lib/matchers.js +88 -0
  10. package/dist/node_modules/@npmcli/redact/lib/server.js +59 -0
  11. package/dist/node_modules/@npmcli/redact/lib/utils.js +202 -0
  12. package/dist/node_modules/{unique-slug → @npmcli/redact}/package.json +21 -18
  13. package/dist/node_modules/brace-expansion/dist/commonjs/index.js +3 -1
  14. package/dist/node_modules/brace-expansion/dist/esm/index.js +3 -1
  15. package/dist/node_modules/brace-expansion/package.json +1 -1
  16. package/dist/node_modules/cacache/lib/content/write.js +2 -2
  17. package/dist/node_modules/cacache/lib/entry-index.js +2 -2
  18. package/dist/node_modules/cacache/lib/util/tmp.js +6 -0
  19. package/dist/node_modules/cacache/package.json +4 -5
  20. package/dist/node_modules/make-fetch-happen/lib/remote.js +4 -2
  21. package/dist/node_modules/make-fetch-happen/package.json +2 -1
  22. package/dist/node_modules/minipass-flush/package.json +6 -3
  23. package/dist/node_modules/picomatch/lib/constants.js +4 -0
  24. package/dist/node_modules/picomatch/lib/parse.js +301 -0
  25. package/dist/node_modules/picomatch/lib/picomatch.js +11 -3
  26. package/dist/node_modules/picomatch/package.json +2 -3
  27. package/dist/node_modules/tar/dist/commonjs/create.js +3 -4
  28. package/dist/node_modules/tar/dist/commonjs/get-write-flag.js +7 -4
  29. package/dist/node_modules/tar/dist/commonjs/header.js +14 -27
  30. package/dist/node_modules/tar/dist/commonjs/index.min.js +3 -3
  31. package/dist/node_modules/tar/dist/commonjs/list.js +2 -7
  32. package/dist/node_modules/tar/dist/commonjs/make-command.js +3 -12
  33. package/dist/node_modules/tar/dist/commonjs/mkdir.js +5 -6
  34. package/dist/node_modules/tar/dist/commonjs/normalize-windows-path.js +1 -1
  35. package/dist/node_modules/tar/dist/commonjs/pack.js +3 -8
  36. package/dist/node_modules/tar/dist/commonjs/parse.js +12 -22
  37. package/dist/node_modules/tar/dist/commonjs/path-reservations.js +2 -2
  38. package/dist/node_modules/tar/dist/commonjs/read-entry.js +2 -6
  39. package/dist/node_modules/tar/dist/commonjs/replace.js +5 -10
  40. package/dist/node_modules/tar/dist/commonjs/unpack.js +38 -63
  41. package/dist/node_modules/tar/dist/commonjs/winchars.js +1 -1
  42. package/dist/node_modules/tar/dist/commonjs/write-entry.js +12 -13
  43. package/dist/node_modules/tar/dist/esm/create.js +3 -4
  44. package/dist/node_modules/tar/dist/esm/get-write-flag.js +7 -4
  45. package/dist/node_modules/tar/dist/esm/header.js +14 -27
  46. package/dist/node_modules/tar/dist/esm/index.min.js +3 -3
  47. package/dist/node_modules/tar/dist/esm/list.js +2 -7
  48. package/dist/node_modules/tar/dist/esm/make-command.js +3 -12
  49. package/dist/node_modules/tar/dist/esm/mkdir.js +5 -6
  50. package/dist/node_modules/tar/dist/esm/normalize-windows-path.js +1 -1
  51. package/dist/node_modules/tar/dist/esm/pack.js +4 -9
  52. package/dist/node_modules/tar/dist/esm/parse.js +13 -23
  53. package/dist/node_modules/tar/dist/esm/path-reservations.js +2 -2
  54. package/dist/node_modules/tar/dist/esm/read-entry.js +2 -6
  55. package/dist/node_modules/tar/dist/esm/replace.js +6 -11
  56. package/dist/node_modules/tar/dist/esm/unpack.js +38 -63
  57. package/dist/node_modules/tar/dist/esm/winchars.js +1 -1
  58. package/dist/node_modules/tar/dist/esm/write-entry.js +14 -15
  59. package/dist/node_modules/tar/package.json +9 -4
  60. package/dist/pnpm.mjs +147455 -129305
  61. package/dist/worker.js +173 -62
  62. package/package.json +12 -9
  63. package/pn +1 -0
  64. package/pnpx +1 -0
  65. package/pnx +1 -0
  66. package/prepare.js +12 -3
  67. package/setup.js +28 -1
  68. package/dist/node_modules/imurmurhash/imurmurhash.js +0 -138
  69. package/dist/node_modules/imurmurhash/imurmurhash.min.js +0 -12
  70. package/dist/node_modules/imurmurhash/package.json +0 -40
  71. package/dist/node_modules/minipass-flush/LICENSE +0 -15
  72. package/dist/node_modules/retry/License +0 -21
  73. package/dist/node_modules/retry/index.js +0 -1
  74. package/dist/node_modules/retry/lib/retry.js +0 -100
  75. package/dist/node_modules/retry/lib/retry_operation.js +0 -162
  76. package/dist/node_modules/retry/package.json +0 -36
  77. package/dist/node_modules/unique-filename/LICENSE +0 -5
  78. package/dist/node_modules/unique-filename/lib/index.js +0 -7
  79. package/dist/node_modules/unique-filename/package.json +0 -53
  80. package/dist/node_modules/unique-slug/LICENSE +0 -15
  81. package/dist/node_modules/unique-slug/lib/index.js +0 -11
@@ -12,12 +12,7 @@ const makeCommand = (syncFile, asyncFile, syncNoFile, asyncNoFile, validate) =>
12
12
  cb = entries;
13
13
  entries = undefined;
14
14
  }
15
- if (!entries) {
16
- entries = [];
17
- }
18
- else {
19
- entries = Array.from(entries);
20
- }
15
+ entries = !entries ? [] : Array.from(entries);
21
16
  const opt = (0, options_js_1.dealias)(opt_);
22
17
  validate?.(opt, entries);
23
18
  if ((0, options_js_1.isSyncFile)(opt)) {
@@ -28,9 +23,7 @@ const makeCommand = (syncFile, asyncFile, syncNoFile, asyncNoFile, validate) =>
28
23
  }
29
24
  else if ((0, options_js_1.isAsyncFile)(opt)) {
30
25
  const p = asyncFile(opt, entries);
31
- // weirdness to make TS happy
32
- const c = cb ? cb : undefined;
33
- return c ? p.then(() => c(), c) : p;
26
+ return cb ? p.then(() => cb(), cb) : p;
34
27
  }
35
28
  else if ((0, options_js_1.isSyncNoFile)(opt)) {
36
29
  if (typeof cb === 'function') {
@@ -45,9 +38,7 @@ const makeCommand = (syncFile, asyncFile, syncNoFile, asyncNoFile, validate) =>
45
38
  return asyncNoFile(opt, entries);
46
39
  /* c8 ignore start */
47
40
  }
48
- else {
49
- throw new Error('impossible options??');
50
- }
41
+ throw new Error('impossible options??');
51
42
  /* c8 ignore stop */
52
43
  }, {
53
44
  syncFile,
@@ -72,7 +72,7 @@ const mkdir = (dir, opt, cb) => {
72
72
  };
73
73
  exports.mkdir = mkdir;
74
74
  const mkdir_ = (base, parts, mode, unlink, cwd, created, cb) => {
75
- if (!parts.length) {
75
+ if (parts.length === 0) {
76
76
  return cb(null, created);
77
77
  }
78
78
  const p = parts.shift();
@@ -83,8 +83,7 @@ const onmkdir = (part, parts, mode, unlink, cwd, created, cb) => (er) => {
83
83
  if (er) {
84
84
  node_fs_1.default.lstat(part, (statEr, st) => {
85
85
  if (statEr) {
86
- statEr.path =
87
- statEr.path && (0, normalize_windows_path_js_1.normalizeWindowsPath)(statEr.path);
86
+ statEr.path = statEr.path && (0, normalize_windows_path_js_1.normalizeWindowsPath)(statEr.path);
88
87
  cb(statEr);
89
88
  }
90
89
  else if (st.isDirectory()) {
@@ -113,7 +112,7 @@ const onmkdir = (part, parts, mode, unlink, cwd, created, cb) => (er) => {
113
112
  };
114
113
  const checkCwdSync = (dir) => {
115
114
  let ok = false;
116
- let code = undefined;
115
+ let code;
117
116
  try {
118
117
  ok = node_fs_1.default.statSync(dir).isDirectory();
119
118
  }
@@ -159,14 +158,14 @@ const mkdirSync = (dir, opt) => {
159
158
  }
160
159
  const sub = (0, normalize_windows_path_js_1.normalizeWindowsPath)(node_path_1.default.relative(cwd, dir));
161
160
  const parts = sub.split('/');
162
- let created = undefined;
161
+ let created;
163
162
  for (let p = parts.shift(), part = cwd; p && (part += '/' + p); p = parts.shift()) {
164
163
  part = (0, normalize_windows_path_js_1.normalizeWindowsPath)(node_path_1.default.resolve(part));
165
164
  try {
166
165
  node_fs_1.default.mkdirSync(part, mode);
167
166
  created = created || part;
168
167
  }
169
- catch (er) {
168
+ catch {
170
169
  const st = node_fs_1.default.lstatSync(part);
171
170
  if (st.isDirectory()) {
172
171
  continue;
@@ -8,5 +8,5 @@ exports.normalizeWindowsPath = void 0;
8
8
  const platform = process.env.TESTING_TAR_FAKE_PLATFORM || process.platform;
9
9
  exports.normalizeWindowsPath = platform !== 'win32' ?
10
10
  (p) => p
11
- : (p) => p && p.replace(/\\/g, '/');
11
+ : (p) => p && p.replaceAll(/\\/g, '/');
12
12
  //# sourceMappingURL=normalize-windows-path.js.map
@@ -126,7 +126,6 @@ class Pack extends minipass_1.Minipass {
126
126
  [PROCESSING] = false;
127
127
  [ENDED] = false;
128
128
  constructor(opt = {}) {
129
- //@ts-ignore
130
129
  super();
131
130
  this.opt = opt;
132
131
  this.file = opt.file || '';
@@ -146,9 +145,7 @@ class Pack extends minipass_1.Minipass {
146
145
  }
147
146
  this.portable = !!opt.portable;
148
147
  if (opt.gzip || opt.brotli || opt.zstd) {
149
- if ((opt.gzip ? 1 : 0) +
150
- (opt.brotli ? 1 : 0) +
151
- (opt.zstd ? 1 : 0) >
148
+ if ((opt.gzip ? 1 : 0) + (opt.brotli ? 1 : 0) + (opt.zstd ? 1 : 0) >
152
149
  1) {
153
150
  throw new TypeError('gzip, brotli, zstd are mutually exclusive');
154
151
  }
@@ -324,7 +321,7 @@ class Pack extends minipass_1.Minipass {
324
321
  }
325
322
  }
326
323
  this[PROCESSING] = false;
327
- if (this[ENDED] && !this[QUEUE].length && this[JOBS] === 0) {
324
+ if (this[ENDED] && this[QUEUE].length === 0 && this[JOBS] === 0) {
328
325
  if (this.zip) {
329
326
  this.zip.end(EOF);
330
327
  }
@@ -368,9 +365,7 @@ class Pack extends minipass_1.Minipass {
368
365
  if (job.ignore) {
369
366
  return;
370
367
  }
371
- if (!this.noDirRecurse &&
372
- job.stat.isDirectory() &&
373
- !job.readdir) {
368
+ if (!this.noDirRecurse && job.stat.isDirectory() && !job.readdir) {
374
369
  const rc = this.readdirCache.get(job.absolute);
375
370
  if (rc) {
376
371
  this[ONREADDIR](job, rc);
@@ -92,8 +92,7 @@ class Parser extends events_1.EventEmitter {
92
92
  this.file = opt.file || '';
93
93
  // these BADARCHIVE errors can't be detected early. listen on DONE.
94
94
  this.on(DONE, () => {
95
- if (this[STATE] === 'begin' ||
96
- this[SAW_VALID_ENTRY] === false) {
95
+ if (this[STATE] === 'begin' || this[SAW_VALID_ENTRY] === false) {
97
96
  // either less than 1 block of data, or all entries were invalid.
98
97
  // Either way, probably not even a tarball.
99
98
  this.warn('TAR_BAD_ARCHIVE', 'Unrecognized archive format');
@@ -223,8 +222,7 @@ class Parser extends events_1.EventEmitter {
223
222
  }
224
223
  else {
225
224
  this[EX] = undefined;
226
- entry.ignore =
227
- entry.ignore || !this.filter(entry.path, entry);
225
+ entry.ignore = entry.ignore || !this.filter(entry.path, entry);
228
226
  if (entry.ignore) {
229
227
  // probably valid, just not something we care about
230
228
  this[EMIT]('ignoredEntry', entry);
@@ -277,7 +275,7 @@ class Parser extends events_1.EventEmitter {
277
275
  }
278
276
  [NEXTENTRY]() {
279
277
  do { } while (this[PROCESSENTRY](this[QUEUE].shift()));
280
- if (!this[QUEUE].length) {
278
+ if (this[QUEUE].length === 0) {
281
279
  // At this point, there's nothing in the queue, but we may have an
282
280
  // entry which is being consumed (readEntry).
283
281
  // If we don't, then we definitely can handle more data.
@@ -327,7 +325,7 @@ class Parser extends events_1.EventEmitter {
327
325
  return ret;
328
326
  }
329
327
  [EMIT](ev, data, extra) {
330
- if (!this[QUEUE].length && !this[READENTRY]) {
328
+ if (this[QUEUE].length === 0 && !this[READENTRY]) {
331
329
  this.emit(ev, data, extra);
332
330
  }
333
331
  else {
@@ -474,11 +472,11 @@ class Parser extends events_1.EventEmitter {
474
472
  }
475
473
  this[WRITING] = false;
476
474
  // return false if there's a queue, or if the current entry isn't flowing
477
- const ret = this[QUEUE].length ? false
475
+ const ret = this[QUEUE].length > 0 ? false
478
476
  : this[READENTRY] ? this[READENTRY].flowing
479
477
  : true;
480
478
  // if we have no queue, then that means a clogged READENTRY
481
- if (!ret && !this[QUEUE].length) {
479
+ if (!ret && this[QUEUE].length === 0) {
482
480
  this[READENTRY]?.once('drain', () => this.emit('drain'));
483
481
  }
484
482
  /* c8 ignore next */
@@ -487,8 +485,7 @@ class Parser extends events_1.EventEmitter {
487
485
  }
488
486
  [BUFFERCONCAT](c) {
489
487
  if (c && !this[ABORTED]) {
490
- this[BUFFER] =
491
- this[BUFFER] ? Buffer.concat([this[BUFFER], c]) : c;
488
+ this[BUFFER] = this[BUFFER] ? Buffer.concat([this[BUFFER], c]) : c;
492
489
  }
493
490
  }
494
491
  [MAYBEEND]() {
@@ -547,9 +544,7 @@ class Parser extends events_1.EventEmitter {
547
544
  // the buffer. Advance the position and put any remainder in the buffer.
548
545
  let position = 0;
549
546
  const length = chunk.length;
550
- while (position + 512 <= length &&
551
- !this[ABORTED] &&
552
- !this[SAW_EOF]) {
547
+ while (position + 512 <= length && !this[ABORTED] && !this[SAW_EOF]) {
553
548
  switch (this[STATE]) {
554
549
  case 'begin':
555
550
  case 'header':
@@ -570,15 +565,10 @@ class Parser extends events_1.EventEmitter {
570
565
  }
571
566
  }
572
567
  if (position < length) {
573
- if (this[BUFFER]) {
574
- this[BUFFER] = Buffer.concat([
575
- chunk.subarray(position),
576
- this[BUFFER],
577
- ]);
578
- }
579
- else {
580
- this[BUFFER] = chunk.subarray(position);
581
- }
568
+ this[BUFFER] =
569
+ this[BUFFER] ?
570
+ Buffer.concat([chunk.subarray(position), this[BUFFER]])
571
+ : chunk.subarray(position);
582
572
  }
583
573
  }
584
574
  end(chunk, encoding, cb) {
@@ -20,7 +20,7 @@ const getDirs = (path) => {
20
20
  .split('/')
21
21
  .slice(0, -1)
22
22
  .reduce((set, path) => {
23
- const s = set[set.length - 1];
23
+ const s = set.at(-1);
24
24
  if (s !== undefined) {
25
25
  path = (0, node_path_1.join)(s, path);
26
26
  }
@@ -63,7 +63,7 @@ class PathReservations {
63
63
  this.#queues.set(dir, [new Set([fn])]);
64
64
  }
65
65
  else {
66
- const l = q[q.length - 1];
66
+ const l = q.at(-1);
67
67
  if (l instanceof Set) {
68
68
  l.add(fn);
69
69
  }
@@ -90,9 +90,7 @@ class ReadEntry extends minipass_1.Minipass {
90
90
  this.ctime = header.ctime;
91
91
  /* c8 ignore start */
92
92
  this.linkpath =
93
- header.linkpath ?
94
- (0, normalize_windows_path_js_1.normalizeWindowsPath)(header.linkpath)
95
- : undefined;
93
+ header.linkpath ? (0, normalize_windows_path_js_1.normalizeWindowsPath)(header.linkpath) : undefined;
96
94
  /* c8 ignore stop */
97
95
  this.uname = header.uname;
98
96
  this.gname = header.gname;
@@ -130,9 +128,7 @@ class ReadEntry extends minipass_1.Minipass {
130
128
  // we slurp in everything except for the path attribute in
131
129
  // a global extended header, because that's weird. Also, any
132
130
  // null/undefined values are ignored.
133
- return !(v === null ||
134
- v === undefined ||
135
- (k === 'path' && gex));
131
+ return !(v === null || v === undefined || (k === 'path' && gex));
136
132
  })));
137
133
  }
138
134
  }
@@ -40,9 +40,7 @@ const replaceSync = (opt, files) => {
40
40
  POSITION: for (position = 0; position < st.size; position += 512) {
41
41
  for (let bufPos = 0, bytes = 0; bufPos < 512; bufPos += bytes) {
42
42
  bytes = node_fs_1.default.readSync(fd, headBuf, bufPos, headBuf.length - bufPos, position + bufPos);
43
- if (position === 0 &&
44
- headBuf[0] === 0x1f &&
45
- headBuf[1] === 0x8b) {
43
+ if (position === 0 && headBuf[0] === 0x1f && headBuf[1] === 0x8b) {
46
44
  throw new Error('cannot append to compressed archives');
47
45
  }
48
46
  if (!bytes) {
@@ -72,7 +70,7 @@ const replaceSync = (opt, files) => {
72
70
  try {
73
71
  node_fs_1.default.closeSync(fd);
74
72
  }
75
- catch (er) { }
73
+ catch { }
76
74
  }
77
75
  }
78
76
  };
@@ -103,16 +101,14 @@ const replaceAsync = (opt, files) => {
103
101
  let bufPos = 0;
104
102
  const headBuf = Buffer.alloc(512);
105
103
  const onread = (er, bytes) => {
106
- if (er || typeof bytes === 'undefined') {
104
+ if (er || bytes === undefined) {
107
105
  return cb(er);
108
106
  }
109
107
  bufPos += bytes;
110
108
  if (bufPos < 512 && bytes) {
111
109
  return node_fs_1.default.read(fd, headBuf, bufPos, headBuf.length - bufPos, position + bufPos, onread);
112
110
  }
113
- if (position === 0 &&
114
- headBuf[0] === 0x1f &&
115
- headBuf[1] === 0x8b) {
111
+ if (position === 0 && headBuf[0] === 0x1f && headBuf[1] === 0x8b) {
116
112
  return cb(new Error('cannot append to compressed archives'));
117
113
  }
118
114
  // truncated header
@@ -191,8 +187,7 @@ const addFilesSync = (p, files) => {
191
187
  p.end();
192
188
  };
193
189
  const addFilesAsync = async (p, files) => {
194
- for (let i = 0; i < files.length; i++) {
195
- const file = String(files[i]);
190
+ for (const file of files) {
196
191
  if (file.charAt(0) === '@') {
197
192
  await (0, list_js_1.list)({
198
193
  file: node_path_1.default.resolve(String(p.cwd), file.slice(1)),
@@ -167,8 +167,7 @@ class Unpack extends parse_js_1.Parser {
167
167
  this.chmod = !!opt.chmod;
168
168
  if (typeof opt.uid === 'number' || typeof opt.gid === 'number') {
169
169
  // need both or neither
170
- if (typeof opt.uid !== 'number' ||
171
- typeof opt.gid !== 'number') {
170
+ if (typeof opt.uid !== 'number' || typeof opt.gid !== 'number') {
172
171
  throw new TypeError('cannot set owner without number uid and gid');
173
172
  }
174
173
  if (opt.preserveOwner) {
@@ -184,13 +183,10 @@ class Unpack extends parse_js_1.Parser {
184
183
  this.setOwner = false;
185
184
  }
186
185
  // default true for root
187
- if (opt.preserveOwner === undefined &&
188
- typeof opt.uid !== 'number') {
189
- this.preserveOwner = !!(process.getuid && process.getuid() === 0);
190
- }
191
- else {
192
- this.preserveOwner = !!opt.preserveOwner;
193
- }
186
+ this.preserveOwner =
187
+ opt.preserveOwner === undefined && typeof opt.uid !== 'number' ?
188
+ !!(process.getuid && process.getuid() === 0)
189
+ : !!opt.preserveOwner;
194
190
  this.processUid =
195
191
  (this.preserveOwner || this.setOwner) && process.getuid ?
196
192
  process.getuid()
@@ -202,9 +198,7 @@ class Unpack extends parse_js_1.Parser {
202
198
  // prevent excessively deep nesting of subfolders
203
199
  // set to `Infinity` to remove this restriction
204
200
  this.maxDepth =
205
- typeof opt.maxDepth === 'number' ?
206
- opt.maxDepth
207
- : DEFAULT_MAX_DEPTH;
201
+ typeof opt.maxDepth === 'number' ? opt.maxDepth : DEFAULT_MAX_DEPTH;
208
202
  // mostly just for testing, but useful in some cases.
209
203
  // Forcibly trigger a chown on every entry, no matter what
210
204
  this.forceChown = opt.forceChown === true;
@@ -262,7 +256,7 @@ class Unpack extends parse_js_1.Parser {
262
256
  return true;
263
257
  // strip off the root
264
258
  const [root, stripped] = (0, strip_absolute_path_js_1.stripAbsolutePath)(p);
265
- const parts = stripped.replace(/\\/g, '/').split('/');
259
+ const parts = stripped.replaceAll(/\\/g, '/').split('/');
266
260
  if (parts.includes('..') ||
267
261
  /* c8 ignore next */
268
262
  (isWindows && /^[a-z]:\.\.$/i.test(parts[0] ?? ''))) {
@@ -278,20 +272,18 @@ class Unpack extends parse_js_1.Parser {
278
272
  // not ok!
279
273
  return false;
280
274
  }
281
- else {
282
- // Resolve linkpath relative to the entry's directory.
283
- // `path.posix` is safe to use because we're operating on
284
- // tar paths, not a filesystem.
285
- const entryDir = node_path_1.default.posix.dirname(entry.path);
286
- const resolved = node_path_1.default.posix.normalize(node_path_1.default.posix.join(entryDir, parts.join('/')));
287
- // If the resolved path escapes (starts with ..), reject it
288
- if (resolved.startsWith('../') || resolved === '..') {
289
- this.warn('TAR_ENTRY_ERROR', `${field} escapes extraction directory`, {
290
- entry,
291
- [field]: p,
292
- });
293
- return false;
294
- }
275
+ // Resolve linkpath relative to the entry's directory.
276
+ // `path.posix` is safe to use because we're operating on
277
+ // tar paths, not a filesystem.
278
+ const entryDir = node_path_1.default.posix.dirname(entry.path);
279
+ const resolved = node_path_1.default.posix.normalize(node_path_1.default.posix.join(entryDir, parts.join('/')));
280
+ // If the resolved path escapes (starts with ..), reject it
281
+ if (resolved.startsWith('../') || resolved === '..') {
282
+ this.warn('TAR_ENTRY_ERROR', `${field} escapes extraction directory`, {
283
+ entry,
284
+ [field]: p,
285
+ });
286
+ return false;
295
287
  }
296
288
  }
297
289
  if (root) {
@@ -337,12 +329,10 @@ class Unpack extends parse_js_1.Parser {
337
329
  !this[STRIPABSOLUTEPATH](entry, 'linkpath')) {
338
330
  return false;
339
331
  }
340
- if (node_path_1.default.isAbsolute(entry.path)) {
341
- entry.absolute = (0, normalize_windows_path_js_1.normalizeWindowsPath)(node_path_1.default.resolve(entry.path));
342
- }
343
- else {
344
- entry.absolute = (0, normalize_windows_path_js_1.normalizeWindowsPath)(node_path_1.default.resolve(this.cwd, entry.path));
345
- }
332
+ entry.absolute =
333
+ node_path_1.default.isAbsolute(entry.path) ?
334
+ (0, normalize_windows_path_js_1.normalizeWindowsPath)(node_path_1.default.resolve(entry.path))
335
+ : (0, normalize_windows_path_js_1.normalizeWindowsPath)(node_path_1.default.resolve(this.cwd, entry.path));
346
336
  // if we somehow ended up with a path that escapes the cwd, and we are
347
337
  // not in preservePaths mode, then something is fishy! This should have
348
338
  // been prevented above, so ignore this for coverage.
@@ -437,8 +427,7 @@ class Unpack extends parse_js_1.Parser {
437
427
  entry.uid !== this.processUid) ||
438
428
  (typeof entry.gid === 'number' &&
439
429
  entry.gid !== this.processGid))) ||
440
- (typeof this.uid === 'number' &&
441
- this.uid !== this.processUid) ||
430
+ (typeof this.uid === 'number' && this.uid !== this.processUid) ||
442
431
  (typeof this.gid === 'number' && this.gid !== this.processGid));
443
432
  }
444
433
  [UID](entry) {
@@ -448,9 +437,7 @@ class Unpack extends parse_js_1.Parser {
448
437
  return uint32(this.gid, entry.gid, this.processGid);
449
438
  }
450
439
  [FILE](entry, fullyDone) {
451
- const mode = typeof entry.mode === 'number' ?
452
- entry.mode & 0o7777
453
- : this.fmode;
440
+ const mode = typeof entry.mode === 'number' ? entry.mode & 0o7777 : this.fmode;
454
441
  const stream = new fsm.WriteStream(String(entry.absolute), {
455
442
  // slight lie, but it can be numeric flags
456
443
  flags: (0, get_write_flag_js_1.getWriteFlag)(entry.size),
@@ -513,16 +500,14 @@ class Unpack extends parse_js_1.Parser {
513
500
  const uid = this[UID](entry);
514
501
  const gid = this[GID](entry);
515
502
  if (typeof uid === 'number' && typeof gid === 'number') {
516
- node_fs_1.default.fchown(fd, uid, gid, er => er ?
517
- node_fs_1.default.chown(abs, uid, gid, er2 => done(er2 && er))
518
- : done());
503
+ node_fs_1.default.fchown(fd, uid, gid, er => er ? node_fs_1.default.chown(abs, uid, gid, er2 => done(er2 && er)) : done());
519
504
  }
520
505
  }
521
506
  done();
522
507
  });
523
508
  const tx = this.transform ? this.transform(entry) || entry : entry;
524
509
  if (tx !== entry) {
525
- tx.on('error', (er) => {
510
+ tx.on('error', er => {
526
511
  this[ONERROR](er, entry);
527
512
  fullyDone();
528
513
  });
@@ -531,9 +516,7 @@ class Unpack extends parse_js_1.Parser {
531
516
  tx.pipe(stream);
532
517
  }
533
518
  [DIRECTORY](entry, fullyDone) {
534
- const mode = typeof entry.mode === 'number' ?
535
- entry.mode & 0o7777
536
- : this.dmode;
519
+ const mode = typeof entry.mode === 'number' ? entry.mode & 0o7777 : this.dmode;
537
520
  this[MKDIR](String(entry.absolute), mode, er => {
538
521
  if (er) {
539
522
  this[ONERROR](er, entry);
@@ -669,9 +652,7 @@ class Unpack extends parse_js_1.Parser {
669
652
  }
670
653
  if (st.isDirectory()) {
671
654
  if (entry.type === 'Directory') {
672
- const needChmod = this.chmod &&
673
- entry.mode &&
674
- (st.mode & 0o7777) !== entry.mode;
655
+ const needChmod = this.chmod && entry.mode && (st.mode & 0o7777) !== entry.mode;
675
656
  const afterChmod = (er) => this[MAKEFS](er ?? null, entry, done);
676
657
  if (!needChmod) {
677
658
  return afterChmod();
@@ -782,9 +763,7 @@ class UnpackSync extends Unpack {
782
763
  }
783
764
  if (st.isDirectory()) {
784
765
  if (entry.type === 'Directory') {
785
- const needChmod = this.chmod &&
786
- entry.mode &&
787
- (st.mode & 0o7777) !== entry.mode;
766
+ const needChmod = this.chmod && entry.mode && (st.mode & 0o7777) !== entry.mode;
788
767
  const [er] = needChmod ?
789
768
  callSync(() => {
790
769
  node_fs_1.default.chmodSync(String(entry.absolute), Number(entry.mode));
@@ -804,9 +783,7 @@ class UnpackSync extends Unpack {
804
783
  this[MAKEFS](er, entry);
805
784
  }
806
785
  [FILE](entry, done) {
807
- const mode = typeof entry.mode === 'number' ?
808
- entry.mode & 0o7777
809
- : this.fmode;
786
+ const mode = typeof entry.mode === 'number' ? entry.mode & 0o7777 : this.fmode;
810
787
  const oner = (er) => {
811
788
  let closeError;
812
789
  try {
@@ -834,7 +811,7 @@ class UnpackSync extends Unpack {
834
811
  /* c8 ignore stop */
835
812
  const tx = this.transform ? this.transform(entry) || entry : entry;
836
813
  if (tx !== entry) {
837
- tx.on('error', (er) => this[ONERROR](er, entry));
814
+ tx.on('error', er => this[ONERROR](er, entry));
838
815
  entry.pipe(tx);
839
816
  }
840
817
  tx.on('data', (chunk) => {
@@ -859,7 +836,7 @@ class UnpackSync extends Unpack {
859
836
  try {
860
837
  node_fs_1.default.utimesSync(String(entry.absolute), atime, mtime);
861
838
  }
862
- catch (utimeser) {
839
+ catch {
863
840
  er = futimeser;
864
841
  }
865
842
  }
@@ -874,7 +851,7 @@ class UnpackSync extends Unpack {
874
851
  try {
875
852
  node_fs_1.default.chownSync(String(entry.absolute), Number(uid), Number(gid));
876
853
  }
877
- catch (chowner) {
854
+ catch {
878
855
  er = er || fchowner;
879
856
  }
880
857
  }
@@ -883,9 +860,7 @@ class UnpackSync extends Unpack {
883
860
  });
884
861
  }
885
862
  [DIRECTORY](entry, done) {
886
- const mode = typeof entry.mode === 'number' ?
887
- entry.mode & 0o7777
888
- : this.dmode;
863
+ const mode = typeof entry.mode === 'number' ? entry.mode & 0o7777 : this.dmode;
889
864
  const er = this[MKDIR](String(entry.absolute), mode);
890
865
  if (er) {
891
866
  this[ONERROR](er, entry);
@@ -897,13 +872,13 @@ class UnpackSync extends Unpack {
897
872
  node_fs_1.default.utimesSync(String(entry.absolute), entry.atime || new Date(), entry.mtime);
898
873
  /* c8 ignore next */
899
874
  }
900
- catch (er) { }
875
+ catch { }
901
876
  }
902
877
  if (this[DOCHOWN](entry)) {
903
878
  try {
904
879
  node_fs_1.default.chownSync(String(entry.absolute), Number(this[UID](entry)), Number(this[GID](entry)));
905
880
  }
906
- catch (er) { }
881
+ catch { }
907
882
  }
908
883
  done();
909
884
  entry.resume();
@@ -927,7 +902,7 @@ class UnpackSync extends Unpack {
927
902
  }
928
903
  }
929
904
  [ENSURE_NO_SYMLINK](_entry, cwd, parts, done, onError) {
930
- if (this.preservePaths || !parts.length)
905
+ if (this.preservePaths || parts.length === 0)
931
906
  return done();
932
907
  let t = cwd;
933
908
  for (const p of parts) {
@@ -4,7 +4,7 @@
4
4
  Object.defineProperty(exports, "__esModule", { value: true });
5
5
  exports.decode = exports.encode = void 0;
6
6
  const raw = ['|', '<', '>', '?', ':'];
7
- const win = raw.map(char => String.fromCharCode(0xf000 + char.charCodeAt(0)));
7
+ const win = raw.map(char => String.fromCodePoint(0xf000 + Number(char.codePointAt(0))));
8
8
  const toWin = new Map(raw.map((char, i) => [char, win[i]]));
9
9
  const toRaw = new Map(win.map((char, i) => [char, raw[i]]));
10
10
  const encode = (s) => raw.reduce((s, c) => s.split(c).join(toWin.get(c)), s);
@@ -122,8 +122,7 @@ class WriteEntry extends minipass_1.Minipass {
122
122
  this.noPax = !!opt.noPax;
123
123
  this.noMtime = !!opt.noMtime;
124
124
  this.mtime = opt.mtime;
125
- this.prefix =
126
- opt.prefix ? (0, normalize_windows_path_js_1.normalizeWindowsPath)(opt.prefix) : undefined;
125
+ this.prefix = opt.prefix ? (0, normalize_windows_path_js_1.normalizeWindowsPath)(opt.prefix) : undefined;
127
126
  this.onWriteEntry = opt.onWriteEntry;
128
127
  if (typeof opt.onwarn === 'function') {
129
128
  this.on('warn', opt.onwarn);
@@ -140,8 +139,8 @@ class WriteEntry extends minipass_1.Minipass {
140
139
  if (this.win32) {
141
140
  // force the \ to / normalization, since we might not *actually*
142
141
  // be on windows, but want \ to be considered a path separator.
143
- this.path = winchars.decode(this.path.replace(/\\/g, '/'));
144
- p = p.replace(/\\/g, '/');
142
+ this.path = winchars.decode(this.path.replaceAll(/\\/g, '/'));
143
+ p = p.replaceAll(/\\/g, '/');
145
144
  }
146
145
  this.absolute = (0, normalize_windows_path_js_1.normalizeWindowsPath)(opt.absolute || path_1.default.resolve(this.cwd, p));
147
146
  if (this.path === '') {
@@ -243,7 +242,7 @@ class WriteEntry extends minipass_1.Minipass {
243
242
  atime: this.portable ? undefined : this.header.atime,
244
243
  ctime: this.portable ? undefined : this.header.ctime,
245
244
  gid: this.portable ? undefined : this.header.gid,
246
- mtime: this.noMtime ? undefined : (this.mtime || this.header.mtime),
245
+ mtime: this.noMtime ? undefined : this.mtime || this.header.mtime,
247
246
  path: this[PREFIX](this.path),
248
247
  linkpath: this.type === 'Link' && this.linkpath !== undefined ?
249
248
  this[PREFIX](this.linkpath)
@@ -446,7 +445,7 @@ class WriteEntry extends minipass_1.Minipass {
446
445
  if (this.blockRemain) {
447
446
  super.write(Buffer.alloc(this.blockRemain));
448
447
  }
449
- return this[CLOSE](er => er ? this.emit('error', er) : this.end());
448
+ return this[CLOSE](er => (er ? this.emit('error', er) : this.end()));
450
449
  }
451
450
  /* c8 ignore start */
452
451
  if (!this.buf) {
@@ -495,7 +494,7 @@ class WriteEntrySync extends WriteEntry {
495
494
  try {
496
495
  this[CLOSE](() => { });
497
496
  }
498
- catch (er) { }
497
+ catch { }
499
498
  }
500
499
  }
501
500
  }
@@ -565,16 +564,13 @@ class WriteEntryTar extends minipass_1.Minipass {
565
564
  this.prefix = opt.prefix;
566
565
  this.path = (0, normalize_windows_path_js_1.normalizeWindowsPath)(readEntry.path);
567
566
  this.mode =
568
- readEntry.mode !== undefined ?
569
- this[MODE](readEntry.mode)
570
- : undefined;
567
+ readEntry.mode !== undefined ? this[MODE](readEntry.mode) : undefined;
571
568
  this.uid = this.portable ? undefined : readEntry.uid;
572
569
  this.gid = this.portable ? undefined : readEntry.gid;
573
570
  this.uname = this.portable ? undefined : readEntry.uname;
574
571
  this.gname = this.portable ? undefined : readEntry.gname;
575
572
  this.size = readEntry.size;
576
- this.mtime =
577
- this.noMtime ? undefined : opt.mtime || readEntry.mtime;
573
+ this.mtime = this.noMtime ? undefined : opt.mtime || readEntry.mtime;
578
574
  this.atime = this.portable ? undefined : readEntry.atime;
579
575
  this.ctime = this.portable ? undefined : readEntry.ctime;
580
576
  this.linkpath =
@@ -686,7 +682,10 @@ class WriteEntryTar extends minipass_1.Minipass {
686
682
  }
687
683
  if (cb)
688
684
  this.once('finish', cb);
689
- chunk ? super.end(chunk, cb) : super.end(cb);
685
+ if (chunk)
686
+ super.end(chunk, cb);
687
+ else
688
+ super.end(cb);
690
689
  /* c8 ignore stop */
691
690
  return this;
692
691
  }