@psnext/slingcli 3.0.20260827-1 → 3.1.20260904-1

package/node_modules/@aws-sdk/credential-provider-http/node_modules/@smithy/node-http-handler/dist-cjs/index.js

@@ -491,6 +491,7 @@ class ClientHttp2SessionRef {
     destroy() {
         this.refs = 0;
         if (!this.session.destroyed) {
+            this.session.setTimeout(0);
             this.session.destroy();
         }
     }
@@ -608,9 +609,8 @@ class NodeHttp2ConnectionManager {
         session.on("error", ensureDestroyed);
         session.on("frameError", ensureDestroyed);
         session.on("close", ensureDestroyed);
-        if (connectionConfiguration.requestTimeout) {
-            session.setTimeout(connectionConfiguration.requestTimeout, ensureDestroyed);
-        }
+        const timeout = connectionConfiguration.requestTimeout ?? 300_000;
+        session.setTimeout(timeout, ensureDestroyed);
         ref.retain();
         return ref;
     }
@@ -817,6 +817,9 @@ class NodeHttp2Handler {
                 resolve({ response: httpResponse });
                 if (useIsolatedSession) {
                     session.close();
+                    clientHttp2Stream.on("end", () => {
+                        ref.destroy();
+                    });
                 }
             });
             clientHttp2Stream.on("close", () => {
@@ -827,7 +830,11 @@ class NodeHttp2Handler {
                     this.connectionManager.release(requestContext, ref);
                 }
                 if (!fulfilled) {
-                    rejectWithDestroy(new Error("Unexpected error: http2 request did not get a response"));
+                    const error = new Error("Unexpected error: http2 request did not get a response");
+                    if (session.destroyed) {
+                        error.name = "TimeoutError";
+                    }
+                    rejectWithDestroy(error);
                 }
             });
             writeRequestBodyPromise = writeRequestBody(clientHttp2Stream, request, effectiveRequestTimeout);

package/node_modules/@aws-sdk/credential-provider-http/node_modules/@smithy/node-http-handler/dist-es/http2/ClientHttp2SessionRef.js

@@ -41,6 +41,7 @@ export class ClientHttp2SessionRef {
     destroy() {
         this.refs = 0;
         if (!this.session.destroyed) {
+            this.session.setTimeout(0);
             this.session.destroy();
         }
     }

package/node_modules/@aws-sdk/credential-provider-http/node_modules/@smithy/node-http-handler/dist-es/node-http2-connection-manager.js

@@ -64,9 +64,8 @@ export class NodeHttp2ConnectionManager {
         session.on("error", ensureDestroyed);
         session.on("frameError", ensureDestroyed);
         session.on("close", ensureDestroyed);
-        if (connectionConfiguration.requestTimeout) {
-            session.setTimeout(connectionConfiguration.requestTimeout, ensureDestroyed);
-        }
+        const timeout = connectionConfiguration.requestTimeout ?? 300_000;
+        session.setTimeout(timeout, ensureDestroyed);
         ref.retain();
         return ref;
     }

package/node_modules/@aws-sdk/credential-provider-http/node_modules/@smithy/node-http-handler/dist-es/node-http2-handler.js

@@ -142,6 +142,9 @@ export class NodeHttp2Handler {
                 resolve({ response: httpResponse });
                 if (useIsolatedSession) {
                     session.close();
+                    clientHttp2Stream.on("end", () => {
+                        ref.destroy();
+                    });
                 }
             });
             clientHttp2Stream.on("close", () => {
@@ -152,7 +155,11 @@ export class NodeHttp2Handler {
                     this.connectionManager.release(requestContext, ref);
                 }
                 if (!fulfilled) {
-                    rejectWithDestroy(new Error("Unexpected error: http2 request did not get a response"));
+                    const error = new Error("Unexpected error: http2 request did not get a response");
+                    if (session.destroyed) {
+                        error.name = "TimeoutError";
+                    }
+                    rejectWithDestroy(error);
                 }
             });
             writeRequestBodyPromise = writeRequestBody(clientHttp2Stream, request, effectiveRequestTimeout);

package/node_modules/@aws-sdk/credential-provider-http/node_modules/@smithy/node-http-handler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smithy/node-http-handler",
-  "version": "4.11.3",
+  "version": "4.12.1",
   "description": "Provides a way to make requests",
   "homepage": "https://github.com/smithy-lang/smithy-typescript/tree/main/packages/node-http-handler",
   "license": "Apache-2.0",
@@ -40,7 +40,7 @@
   },
   "dependencies": {
     "@smithy/core": "^3.33.3",
-    "@smithy/types": "^4.17.2",
+    "@smithy/types": "^4.18.0",
     "tslib": "^2.6.2"
   },
   "devDependencies": {

package/node_modules/@aws-sdk/credential-provider-node/dist-cjs/index.js

@@ -52,6 +52,8 @@ function memoizeChain(providers, treatAsExpired) {
                     passiveLock = chain(options)
                         .then((c) => {
                         credentials = c;
+                    })
+                        .catch(() => {
                     })
                         .finally(() => {
                         passiveLock = undefined;

package/node_modules/@aws-sdk/credential-provider-node/dist-es/runtime/memoize-chain.js

@@ -32,6 +32,8 @@ export function memoizeChain(providers, treatAsExpired) {
                     passiveLock = chain(options)
                         .then((c) => {
                         credentials = c;
+                    })
+                        .catch(() => {
                     })
                         .finally(() => {
                         passiveLock = undefined;

package/node_modules/@aws-sdk/credential-provider-node/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/credential-provider-node",
-  "version": "3.972.81",
+  "version": "3.972.82",
   "description": "AWS credential provider that sources credentials from a Node.JS environment. ",
   "keywords": [
     "aws",

package/node_modules/@aws-sdk/nested-clients/node_modules/@smithy/node-http-handler/dist-cjs/index.js

@@ -491,6 +491,7 @@ class ClientHttp2SessionRef {
     destroy() {
         this.refs = 0;
         if (!this.session.destroyed) {
+            this.session.setTimeout(0);
             this.session.destroy();
         }
     }
@@ -608,9 +609,8 @@ class NodeHttp2ConnectionManager {
         session.on("error", ensureDestroyed);
         session.on("frameError", ensureDestroyed);
         session.on("close", ensureDestroyed);
-        if (connectionConfiguration.requestTimeout) {
-            session.setTimeout(connectionConfiguration.requestTimeout, ensureDestroyed);
-        }
+        const timeout = connectionConfiguration.requestTimeout ?? 300_000;
+        session.setTimeout(timeout, ensureDestroyed);
         ref.retain();
         return ref;
     }
@@ -817,6 +817,9 @@ class NodeHttp2Handler {
                 resolve({ response: httpResponse });
                 if (useIsolatedSession) {
                     session.close();
+                    clientHttp2Stream.on("end", () => {
+                        ref.destroy();
+                    });
                 }
             });
             clientHttp2Stream.on("close", () => {
@@ -827,7 +830,11 @@ class NodeHttp2Handler {
                     this.connectionManager.release(requestContext, ref);
                 }
                 if (!fulfilled) {
-                    rejectWithDestroy(new Error("Unexpected error: http2 request did not get a response"));
+                    const error = new Error("Unexpected error: http2 request did not get a response");
+                    if (session.destroyed) {
+                        error.name = "TimeoutError";
+                    }
+                    rejectWithDestroy(error);
                 }
             });
             writeRequestBodyPromise = writeRequestBody(clientHttp2Stream, request, effectiveRequestTimeout);

package/node_modules/@aws-sdk/nested-clients/node_modules/@smithy/node-http-handler/dist-es/http2/ClientHttp2SessionRef.js

@@ -41,6 +41,7 @@ export class ClientHttp2SessionRef {
     destroy() {
         this.refs = 0;
         if (!this.session.destroyed) {
+            this.session.setTimeout(0);
             this.session.destroy();
         }
     }

package/node_modules/@aws-sdk/nested-clients/node_modules/@smithy/node-http-handler/dist-es/node-http2-connection-manager.js

@@ -64,9 +64,8 @@ export class NodeHttp2ConnectionManager {
         session.on("error", ensureDestroyed);
         session.on("frameError", ensureDestroyed);
         session.on("close", ensureDestroyed);
-        if (connectionConfiguration.requestTimeout) {
-            session.setTimeout(connectionConfiguration.requestTimeout, ensureDestroyed);
-        }
+        const timeout = connectionConfiguration.requestTimeout ?? 300_000;
+        session.setTimeout(timeout, ensureDestroyed);
         ref.retain();
         return ref;
     }

package/node_modules/@aws-sdk/nested-clients/node_modules/@smithy/node-http-handler/dist-es/node-http2-handler.js

@@ -142,6 +142,9 @@ export class NodeHttp2Handler {
                 resolve({ response: httpResponse });
                 if (useIsolatedSession) {
                     session.close();
+                    clientHttp2Stream.on("end", () => {
+                        ref.destroy();
+                    });
                 }
             });
             clientHttp2Stream.on("close", () => {
@@ -152,7 +155,11 @@ export class NodeHttp2Handler {
                     this.connectionManager.release(requestContext, ref);
                 }
                 if (!fulfilled) {
-                    rejectWithDestroy(new Error("Unexpected error: http2 request did not get a response"));
+                    const error = new Error("Unexpected error: http2 request did not get a response");
+                    if (session.destroyed) {
+                        error.name = "TimeoutError";
+                    }
+                    rejectWithDestroy(error);
                 }
             });
             writeRequestBodyPromise = writeRequestBody(clientHttp2Stream, request, effectiveRequestTimeout);

package/node_modules/@aws-sdk/nested-clients/node_modules/@smithy/node-http-handler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smithy/node-http-handler",
-  "version": "4.11.3",
+  "version": "4.12.1",
   "description": "Provides a way to make requests",
   "homepage": "https://github.com/smithy-lang/smithy-typescript/tree/main/packages/node-http-handler",
   "license": "Apache-2.0",
@@ -40,7 +40,7 @@
   },
   "dependencies": {
     "@smithy/core": "^3.33.3",
-    "@smithy/types": "^4.17.2",
+    "@smithy/types": "^4.18.0",
     "tslib": "^2.6.2"
   },
   "devDependencies": {

package/node_modules/@earendil-works/pi-telemetry/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@earendil-works/pi-telemetry",
-	"version": "0.84.3",
+	"version": "0.84.4",
 	"description": "Vendor-neutral telemetry contracts and typed schema utilities for pi",
 	"type": "module",
 	"main": "./dist/index.js",

package/node_modules/@smithy/fetch-http-handler/dist-cjs/index.js

@@ -51,6 +51,7 @@ class FetchHttpHandler {
         const requestTimeoutInMs = requestTimeout$1 ?? this.config.requestTimeout;
         const keepAlive = this.config.keepAlive === true;
         const credentials = this.config.credentials;
+        const fetchFn = this.config.customFetch ?? fetch;
         if (abortSignal?.aborted) {
             const abortError = buildAbortError(abortSignal);
             return Promise.reject(abortError);
@@ -96,7 +97,7 @@ class FetchHttpHandler {
         let removeSignalEventListener = () => { };
         const fetchRequest = createRequest(url, requestOptions);
         const raceOfPromises = [
-            fetch(fetchRequest).then((response) => {
+            fetchFn(fetchRequest).then((response) => {
                 const fetchHeaders = response.headers;
                 const transformedHeaders = {};
                 for (const pair of fetchHeaders.entries()) {

package/node_modules/@smithy/fetch-http-handler/dist-es/fetch-http-handler.js

@@ -34,6 +34,7 @@ export class FetchHttpHandler {
         const requestTimeoutInMs = requestTimeout ?? this.config.requestTimeout;
         const keepAlive = this.config.keepAlive === true;
         const credentials = this.config.credentials;
+        const fetchFn = this.config.customFetch ?? fetch;
         if (abortSignal?.aborted) {
             const abortError = buildAbortError(abortSignal);
             return Promise.reject(abortError);
@@ -79,7 +80,7 @@ export class FetchHttpHandler {
         let removeSignalEventListener = () => { };
         const fetchRequest = createRequest(url, requestOptions);
         const raceOfPromises = [
-            fetch(fetchRequest).then((response) => {
+            fetchFn(fetchRequest).then((response) => {
                 const fetchHeaders = response.headers;
                 const transformedHeaders = {};
                 for (const pair of fetchHeaders.entries()) {

package/node_modules/@smithy/fetch-http-handler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smithy/fetch-http-handler",
-  "version": "5.7.2",
+  "version": "5.8.0",
   "description": "Provides a way to make requests",
   "homepage": "https://github.com/smithy-lang/smithy-typescript/tree/main/packages/fetch-http-handler",
   "license": "Apache-2.0",
@@ -40,8 +40,8 @@
     "test:browser:watch": "yarn g:vitest watch -c vitest.config.browser.mts"
   },
   "dependencies": {
-    "@smithy/core": "^3.33.2",
-    "@smithy/types": "^4.17.2",
+    "@smithy/core": "^3.33.3",
+    "@smithy/types": "^4.18.0",
     "tslib": "^2.6.2"
   },
   "devDependencies": {

package/node_modules/@smithy/types/dist-types/http/httpHandlerInitialization.d.ts

@@ -118,6 +118,20 @@ export interface FetchHttpHandlerOptions {
      * ```
      */
     requestInit?: (httpRequest: IHttpRequest) => RequestInit;
+    /**
+     * An optional custom fetch implementation to use in place of the
+     * global fetch function.
+     *
+     * @example
+     * ```js
+     * new Client({
+     *   requestHandler: {
+     *     customFetch: (request) => myFetchImplementation(request)
+     *   }
+     * });
+     * ```
+     */
+    customFetch?: typeof fetch;
 }
 declare global {
     /**

package/node_modules/@smithy/types/dist-types/ts3.4/http/httpHandlerInitialization.d.ts

@@ -118,6 +118,20 @@ export interface FetchHttpHandlerOptions {
      * ```
      */
     requestInit?: (httpRequest: IHttpRequest) => RequestInit;
+    /**
+     * An optional custom fetch implementation to use in place of the
+     * global fetch function.
+     *
+     * @example
+     * ```js
+     * new Client({
+     *   requestHandler: {
+     *     customFetch: (request) => myFetchImplementation(request)
+     *   }
+     * });
+     * ```
+     */
+    customFetch?: typeof fetch;
 }
 declare global {
     /**

package/node_modules/@smithy/types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smithy/types",
-  "version": "4.17.2",
+  "version": "4.18.0",
   "homepage": "https://github.com/smithy-lang/smithy-typescript/tree/main/packages/types",
   "license": "Apache-2.0",
   "author": {

package/node_modules/@types/node/README.md

@@ -8,7 +8,7 @@ This package contains type definitions for node (https://nodejs.org/).
 Files were exported from https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node.
 
 ### Additional Details
- * Last updated: Thu, 27 Aug 2026 00:14:49 GMT
+ * Last updated: Tue, 01 Sep 2026 20:06:05 GMT
  * Dependencies: [undici-types](https://npmjs.com/package/undici-types)
 
 # Credits

package/node_modules/@types/node/ffi.d.ts

@@ -459,7 +459,7 @@ declare module "node:ffi" {
         "void": void;
         "number": number;
         "bigint": bigint;
-        "pointer": bigint | null;
+        "pointer": bigint;
     }
     enum types {
         VOID = "void",

package/node_modules/@types/node/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@types/node",
-    "version": "26.4.0",
+    "version": "26.4.1",
     "description": "TypeScript definitions for node",
     "homepage": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node",
     "license": "MIT",
@@ -150,6 +150,6 @@
         "undici-types": "~8.3.0"
     },
     "peerDependencies": {},
-    "typesPublisherContentHash": "0793b8d36264e159c56982e4bc1d7024a8a703b13431ee414c7feacfe570e674",
+    "typesPublisherContentHash": "463ff626c280fc7ad82097e8ff9ab6bd4a19fb2b4c56c8d56c2b8148cd872d0c",
     "typeScriptVersion": "5.6"
 }

package/node_modules/express-rate-limit/dist/index.cjs

@@ -297,9 +297,9 @@ var setDraft8Headers = (response, info, windowMs, name, key) => {
   response.append("RateLimit", `"${name}"; ${header}`);
   response.append("RateLimit-Policy", `"${name}"; ${policy}`);
 };
-var setRetryAfterHeader = (response, info, windowMs) => {
+var setRetryAfterHeader = (response, info, windowMs, retryAfter) => {
   if (response.headersSent) return;
-  const resetSeconds = getResetSeconds(windowMs, info.resetTime);
+  const resetSeconds = retryAfter ?? getResetSeconds(windowMs, info.resetTime);
   response.setHeader("Retry-After", resetSeconds.toString());
 };
 
@@ -566,6 +566,7 @@ var validations = {
       legacyHeaders: true,
       standardHeaders: true,
       identifier: true,
+      retryAfter: true,
       requestPropertyName: true,
       skipFailedRequests: true,
       skipSuccessfulRequests: true,
@@ -1050,7 +1051,9 @@ var rateLimit = (passedOptions) => {
         debug("limit exceeded");
         if (config.legacyHeaders || config.standardHeaders) {
           debug("set retry-after header");
-          setRetryAfterHeader(response, info, config.windowMs);
+          const retrieveRetryAfter = typeof config.retryAfter === "function" ? config.retryAfter(request, response) : config.retryAfter;
+          const retryAfter = await retrieveRetryAfter;
+          setRetryAfterHeader(response, info, config.windowMs, retryAfter);
         }
         config.handler(request, response, next, options);
         return;

package/node_modules/express-rate-limit/dist/index.d.cts

@@ -408,6 +408,17 @@ export type Options = {
 	 * Defaults to `{limit}-in-{window}`.
 	 */
 	identifier: string | ValueDeterminingMiddleware<string>;
+	/**
+	 * Method to generate a custom `Retry-After` header value (in seconds) when
+	 * a client is rate limited.
+	 *
+	 * This is advisory only, it customizes what the header says, it does not
+	 * change how long the limiter actually keeps blocking the client for.
+	 * That is still controlled by `windowMs`.
+	 *
+	 * By default, the number of seconds remaining until the window resets.
+	 */
+	retryAfter?: number | ValueDeterminingMiddleware<number>;
 	/**
 	 * The name of the property on the request object to store the rate limit info.
 	 *

package/node_modules/express-rate-limit/dist/index.d.mts

@@ -408,6 +408,17 @@ export type Options = {
 	 * Defaults to `{limit}-in-{window}`.
 	 */
 	identifier: string | ValueDeterminingMiddleware<string>;
+	/**
+	 * Method to generate a custom `Retry-After` header value (in seconds) when
+	 * a client is rate limited.
+	 *
+	 * This is advisory only, it customizes what the header says, it does not
+	 * change how long the limiter actually keeps blocking the client for.
+	 * That is still controlled by `windowMs`.
+	 *
+	 * By default, the number of seconds remaining until the window resets.
+	 */
+	retryAfter?: number | ValueDeterminingMiddleware<number>;
 	/**
 	 * The name of the property on the request object to store the rate limit info.
 	 *

package/node_modules/express-rate-limit/dist/index.d.ts

@@ -408,6 +408,17 @@ export type Options = {
 	 * Defaults to `{limit}-in-{window}`.
 	 */
 	identifier: string | ValueDeterminingMiddleware<string>;
+	/**
+	 * Method to generate a custom `Retry-After` header value (in seconds) when
+	 * a client is rate limited.
+	 *
+	 * This is advisory only, it customizes what the header says, it does not
+	 * change how long the limiter actually keeps blocking the client for.
+	 * That is still controlled by `windowMs`.
+	 *
+	 * By default, the number of seconds remaining until the window resets.
+	 */
+	retryAfter?: number | ValueDeterminingMiddleware<number>;
 	/**
 	 * The name of the property on the request object to store the rate limit info.
 	 *

package/node_modules/express-rate-limit/dist/index.mjs

@@ -254,9 +254,9 @@ var setDraft8Headers = (response, info, windowMs, name, key) => {
   response.append("RateLimit", `"${name}"; ${header}`);
   response.append("RateLimit-Policy", `"${name}"; ${policy}`);
 };
-var setRetryAfterHeader = (response, info, windowMs) => {
+var setRetryAfterHeader = (response, info, windowMs, retryAfter) => {
   if (response.headersSent) return;
-  const resetSeconds = getResetSeconds(windowMs, info.resetTime);
+  const resetSeconds = retryAfter ?? getResetSeconds(windowMs, info.resetTime);
   response.setHeader("Retry-After", resetSeconds.toString());
 };
 
@@ -523,6 +523,7 @@ var validations = {
       legacyHeaders: true,
       standardHeaders: true,
       identifier: true,
+      retryAfter: true,
       requestPropertyName: true,
       skipFailedRequests: true,
       skipSuccessfulRequests: true,
@@ -1007,7 +1008,9 @@ var rateLimit = (passedOptions) => {
         debug("limit exceeded");
         if (config.legacyHeaders || config.standardHeaders) {
           debug("set retry-after header");
-          setRetryAfterHeader(response, info, config.windowMs);
+          const retrieveRetryAfter = typeof config.retryAfter === "function" ? config.retryAfter(request, response) : config.retryAfter;
+          const retryAfter = await retrieveRetryAfter;
+          setRetryAfterHeader(response, info, config.windowMs, retryAfter);
         }
         config.handler(request, response, next, options);
         return;

package/node_modules/express-rate-limit/{license.md → license}

@@ -1,4 +1,4 @@
-# MIT License
+MIT License
 
 Copyright 2023 Nathan Friedly, Vedant K
 
@@ -13,8 +13,9 @@ The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
-FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
-COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
-IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/express-rate-limit/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "express-rate-limit",
-	"version": "8.6.2",
+	"version": "8.7.0",
 	"description": "Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.",
 	"author": {
 		"name": "Nathan Friedly",
@@ -90,16 +90,16 @@
 		"@types/debug": "4.1.13",
 		"@types/express": "5.0.6",
 		"@types/jest": "30.0.0",
-		"@types/node": "26.1.2",
+		"@types/node": "26.2.0",
 		"@types/supertest": "7.2.1",
 		"del-cli": "7.0.0",
 		"dts-bundle-generator": "8.1.2",
-		"esbuild": "0.28.1",
+		"esbuild": "0.28.2",
 		"express": "5.2.1",
 		"husky": "9.1.7",
 		"jest": "30.4.2",
-		"lint-staged": "17.2.0",
-		"mintlify": "4.2.743",
+		"lint-staged": "17.3.0",
+		"mintlify": "4.2.817",
 		"npm-run-all": "4.1.5",
 		"prettier": "3.9.6",
 		"ratelimit-header-parser": "0.1.0",

package/node_modules/express-rate-limit/readme.md

@@ -5,6 +5,7 @@
 [![tests](https://img.shields.io/github/actions/workflow/status/express-rate-limit/express-rate-limit/ci.yaml)](https://github.com/express-rate-limit/express-rate-limit/actions/workflows/ci.yaml)
 [![npm version](https://img.shields.io/npm/v/express-rate-limit.svg)](https://npmjs.org/package/express-rate-limit 'View this project on NPM')
 [![npm downloads](https://img.shields.io/npm/dm/express-rate-limit)](https://www.npmjs.com/package/express-rate-limit)
+[![inspect.software](https://raw.githubusercontent.com/inspect-software/badges/main/v1/e/express-rate-limit/express-rate-limit.svg)](https://inspect.software/software/express-rate-limit/express-rate-limit)
 [![license](https://img.shields.io/npm/l/express-rate-limit)](license.md)
 
 </div>

package/node_modules/fast-uri/index.js

@@ -324,6 +324,18 @@ function hasMalformedPercentEncoding (component) {
   return false
 }
 
+/**
+ * Whether the host is a bracketed IP literal (RFC 3986 `IP-literal`).
+ * An unterminated `[` is not a literal, so it must still be validated as a
+ * reg-name instead of being waved through as an IP.
+ *
+ * @param {string} host
+ * @returns {boolean}
+ */
+function isIPLiteral (host) {
+  return host[0] === '[' && host[host.length - 1] === ']'
+}
+
 /**
  * @param {RegExpMatchArray} matches
  * @returns {boolean}
@@ -333,7 +345,7 @@ function hasMalformedComponentPercentEncoding (matches) {
   // compatibility. Their parsing is intentionally left to normalizeIPv6.
   const host = matches[4]
   return hasMalformedPercentEncoding(matches[3]) ||
-    (host !== undefined && !(host[0] === '[' && host[host.length - 1] === ']') && hasMalformedPercentEncoding(host)) ||
+    (host !== undefined && !isIPLiteral(host) && hasMalformedPercentEncoding(host)) ||
     hasMalformedPercentEncoding(matches[6]) ||
     hasMalformedPercentEncoding(matches[7]) ||
     hasMalformedPercentEncoding(matches[8])
@@ -351,7 +363,7 @@ function canonicalizeHost (parsed, options, schemeHandler, isIP) {
     !options.unicodeSupport &&
     (!schemeHandler || !schemeHandler.unicodeSupport) &&
     parsed.host &&
-    parsed.host[0] !== '[' &&
+    !isIPLiteral(parsed.host) &&
     (options.domainHost || (schemeHandler && schemeHandler.domainHost)) &&
     isIP === false &&
     nonSimpleDomain(parsed.host)
@@ -476,10 +488,11 @@ function parseWithStatus (uri, opts) {
     if (parsed.host) {
       const ipv4result = isIPv4(parsed.host)
       if (ipv4result === false) {
-        const bracketedIPLiteral = parsed.host[0] === '[' && parsed.host[parsed.host.length - 1] === ']'
+        const bracketedIPLiteral = isIPLiteral(parsed.host)
+        const hasIPLiteralBracket = parsed.host.indexOf('[') !== -1 || parsed.host.indexOf(']') !== -1
         const ipv6result = normalizeIPv6(parsed.host)
         isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true
-        malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true
+        malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true)
         parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase()
 
         if (malformedIPLiteral) {
@@ -509,7 +522,9 @@ function parseWithStatus (uri, opts) {
     const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme)
 
     // convert Unicode IDN -> ASCII IDN when the effective scheme uses domain hosts
-    malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
+    if (!malformedIPLiteral) {
+      malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
+    }
 
     if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
       if (uri.indexOf('%') !== -1) {