@psnext/slingcli 3.3.20260911-1 → 3.3.20260915-1

package/node_modules/proxy-addr/HISTORY.md

@@ -1,144 +1,150 @@
-2.0.7 / 2021-05-31
-==================
+2.0.8
+=====
+
+  * Fix [CVE-2026-90711](https://www.cve.org/CVERecord?id=CVE-2026-90711) ([GHSA-jqcg-44mw-7w3h](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h))
+
+
+2.0.7
+=====
 
   * deps: forwarded@0.2.0
     - Use `req.socket` over deprecated `req.connection`
 
-2.0.6 / 2020-02-24
-==================
+2.0.6
+=====
 
   * deps: ipaddr.js@1.9.1
 
-2.0.5 / 2019-04-16
-==================
+2.0.5
+=====
 
   * deps: ipaddr.js@1.9.0
 
-2.0.4 / 2018-07-26
-==================
+2.0.4
+=====
 
   * deps: ipaddr.js@1.8.0
 
-2.0.3 / 2018-02-19
-==================
+2.0.3
+=====
 
   * deps: ipaddr.js@1.6.0
 
-2.0.2 / 2017-09-24
-==================
+2.0.2
+=====
 
   * deps: forwarded@~0.1.2
     - perf: improve header parsing
     - perf: reduce overhead when no `X-Forwarded-For` header
 
-2.0.1 / 2017-09-10
-==================
+2.0.1
+=====
 
   * deps: forwarded@~0.1.1
     - Fix trimming leading / trailing OWS
     - perf: hoist regular expression
   * deps: ipaddr.js@1.5.2
 
-2.0.0 / 2017-08-08
-==================
+2.0.0
+=====
 
   * Drop support for Node.js below 0.10
 
-1.1.5 / 2017-07-25
-==================
+1.1.5
+=====
 
   * Fix array argument being altered
   * deps: ipaddr.js@1.4.0
 
-1.1.4 / 2017-03-24
-==================
+1.1.4
+=====
 
   * deps: ipaddr.js@1.3.0
 
-1.1.3 / 2017-01-14
-==================
+1.1.3
+=====
 
   * deps: ipaddr.js@1.2.0
 
-1.1.2 / 2016-05-29
-==================
+1.1.2
+=====
 
   * deps: ipaddr.js@1.1.1
     - Fix IPv6-mapped IPv4 validation edge cases
 
-1.1.1 / 2016-05-03
-==================
+1.1.1
+=====
 
   * Fix regression matching mixed versions against multiple subnets
 
-1.1.0 / 2016-05-01
-==================
+1.1.0
+=====
 
   * Fix accepting various invalid netmasks
     - IPv4 netmasks must be contingous
     - IPv6 addresses cannot be used as a netmask
   * deps: ipaddr.js@1.1.0
 
-1.0.10 / 2015-12-09
-===================
+1.0.10
+======
 
   * deps: ipaddr.js@1.0.5
     - Fix regression in `isValid` with non-string arguments
 
-1.0.9 / 2015-12-01
-==================
+1.0.9
+=====
 
   * deps: ipaddr.js@1.0.4
     - Fix accepting some invalid IPv6 addresses
     - Reject CIDRs with negative or overlong masks
   * perf: enable strict mode
 
-1.0.8 / 2015-05-10
-==================
+1.0.8
+=====
 
   * deps: ipaddr.js@1.0.1
 
-1.0.7 / 2015-03-16
-==================
+1.0.7
+=====
 
   * deps: ipaddr.js@0.1.9
     - Fix OOM on certain inputs to `isValid`
 
-1.0.6 / 2015-02-01
-==================
+1.0.6
+=====
 
   * deps: ipaddr.js@0.1.8
 
-1.0.5 / 2015-01-08
-==================
+1.0.5
+=====
 
   * deps: ipaddr.js@0.1.6
 
-1.0.4 / 2014-11-23
-==================
+1.0.4
+=====
 
   * deps: ipaddr.js@0.1.5
     - Fix edge cases with `isValid`
 
-1.0.3 / 2014-09-21
-==================
+1.0.3
+=====
 
   * Use `forwarded` npm module
 
-1.0.2 / 2014-09-18
-==================
+1.0.2
+=====
 
   * Fix a global leak when multiple subnets are trusted
   * Support Node.js 0.6
   * deps: ipaddr.js@0.1.3
 
-1.0.1 / 2014-06-03
-==================
+1.0.1
+=====
 
   * Fix links in npm package
 
-1.0.0 / 2014-05-08
-==================
+1.0.0
+=====
 
   * Add `trust` argument to determine proxy trust on
     * Accepts custom function
@@ -150,12 +156,12 @@
   * Add `proxyaddr.compile` to pre-compile `trust` function
     to make subsequent calls faster
 
-0.0.1 / 2014-05-04
-==================
+0.0.1
+=====
 
   * Fix bad npm publish
 
-0.0.0 / 2014-05-04
-==================
+0.0.0
+=====
 
   * Initial release

package/node_modules/proxy-addr/README.md

@@ -37,7 +37,7 @@ proxyaddr(req, function (addr) { return addr === '127.0.0.1' })
 proxyaddr(req, function (addr, i) { return i < 1 })
 ```
 
-The `trust` arugment may also be a single IP address string or an
+The `trust` argument may also be a single IP address string or an
 array of trusted addresses, as plain IP addresses, CIDR-formatted
 strings, or IP/netmask strings.
 

package/node_modules/proxy-addr/index.js

@@ -256,6 +256,13 @@ function trustMulti (subnets) {
     if (!isip(addr)) return false
 
     var ip = parseip(addr)
+
+    if (ip.kind() === 'ipv6' && ip.isIPv4MappedAddress()) {
+      // Canonicalize IPv4-mapped candidates to IPv4 so a mapped address
+      // cannot bypass the cross-family guard via the same-family path
+      ip = ip.toIPv4Address()
+    }
+
     var ipconv
     var kind = ip.kind()
 
@@ -272,6 +279,12 @@ function trustMulti (subnets) {
           continue
         }
 
+        if (subnetkind !== 'ipv4' && !(subnetrange >= 96 && subnetip.isIPv4MappedAddress())) {
+          // IPv6 subnet only spans IPv4 when it is a mapped subnet whose
+          // prefix covers the ::ffff: marker; otherwise it must not match IPv4
+          continue
+        }
+
         if (!ipconv) {
           // Convert IP to match subnet IP kind
           ipconv = subnetkind === 'ipv4'
@@ -280,6 +293,9 @@ function trustMulti (subnets) {
         }
 
         trusted = ipconv
+      } else if (kind === 'ipv6' && subnetip.isIPv4MappedAddress()) {
+        // A native IPv6 candidate cannot match an IPv4-mapped subnet
+        continue
       }
 
       if (trusted.match(subnetip, subnetrange)) {
@@ -308,6 +324,13 @@ function trustSingle (subnet) {
     if (!isip(addr)) return false
 
     var ip = parseip(addr)
+
+    if (ip.kind() === 'ipv6' && ip.isIPv4MappedAddress()) {
+      // Canonicalize IPv4-mapped candidates to IPv4 so a mapped address
+      // cannot bypass the cross-family guard via the same-family path
+      ip = ip.toIPv4Address()
+    }
+
     var kind = ip.kind()
 
     if (kind !== subnetkind) {
@@ -316,10 +339,19 @@ function trustSingle (subnet) {
         return false
       }
 
+      if (!subnetisipv4 && !(subnetrange >= 96 && subnetip.isIPv4MappedAddress())) {
+        // IPv6 subnet only spans IPv4 when it is a mapped subnet whose
+        // prefix covers the ::ffff: marker; otherwise it must not match IPv4
+        return false
+      }
+
       // Convert IP to match subnet IP kind
       ip = subnetisipv4
         ? ip.toIPv4Address()
         : ip.toIPv4MappedAddress()
+    } else if (kind === 'ipv6' && subnetip.isIPv4MappedAddress()) {
+      // A native IPv6 candidate cannot match an IPv4-mapped subnet
+      return false
     }
 
     return ip.match(subnetip, subnetrange)

package/node_modules/proxy-addr/package.json

@@ -1,7 +1,7 @@
 {
   "name": "proxy-addr",
   "description": "Determine address of proxied request",
-  "version": "2.0.7",
+  "version": "2.0.8",
   "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",
   "license": "MIT",
   "keywords": [
@@ -10,6 +10,10 @@
     "x-forwarded-for"
   ],
   "repository": "jshttp/proxy-addr",
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
+  },
   "dependencies": {
     "forwarded": "0.2.0",
     "ipaddr.js": "1.9.1"
@@ -17,11 +21,11 @@
   "devDependencies": {
     "benchmark": "2.1.4",
     "beautify-benchmark": "0.2.4",
-    "deep-equal": "1.0.1",
+    "deep-equal": "1.1.2",
     "eslint": "7.26.0",
     "eslint-config-standard": "14.1.1",
-    "eslint-plugin-import": "2.23.4",
-    "eslint-plugin-markdown": "2.2.0",
+    "eslint-plugin-import": "2.32.0",
+    "eslint-plugin-markdown": "2.2.1",
     "eslint-plugin-node": "11.1.0",
     "eslint-plugin-promise": "4.3.1",
     "eslint-plugin-standard": "4.1.0",

package/node_modules/undici-types/agent.d.ts

@@ -1,31 +1,30 @@
-import { URL } from 'url'
+import { URL } from 'node:url'
 import Pool from './pool'
-import Dispatcher from "./dispatcher";
+import Dispatcher from './dispatcher'
+import TClientStats from './client-stats'
+import TPoolStats from './pool-stats'
 
 export default Agent
 
-declare class Agent extends Dispatcher{
-  constructor(opts?: Agent.Options)
+declare class Agent extends Dispatcher {
+  constructor (opts?: Agent.Options)
   /** `true` after `dispatcher.close()` has been called. */
-  closed: boolean;
+  closed: boolean
   /** `true` after `dispatcher.destroyed()` has been called or `dispatcher.close()` has been called and the dispatcher shutdown has completed. */
-  destroyed: boolean;
+  destroyed: boolean
   /** Dispatches a request. */
-  dispatch(options: Agent.DispatchOptions, handler: Dispatcher.DispatchHandlers): boolean;
+  dispatch (options: Agent.DispatchOptions, handler: Dispatcher.DispatchHandler): boolean
+  /** Aggregate stats for a Agent by origin. */
+  readonly stats: Record<string, TClientStats | TPoolStats>
 }
 
 declare namespace Agent {
   export interface Options extends Pool.Options {
     /** Default: `(origin, opts) => new Pool(origin, opts)`. */
     factory?(origin: string | URL, opts: Object): Dispatcher;
-    /** Integer. Default: `0` */
-    maxRedirections?: number;
-
-    interceptors?: { Agent?: readonly Dispatcher.DispatchInterceptor[] } & Pool.Options["interceptors"]
+    maxOrigins?: number
   }
 
   export interface DispatchOptions extends Dispatcher.DispatchOptions {
-    /** Integer. */
-    maxRedirections?: number;
   }
 }

package/node_modules/undici-types/api.d.ts

@@ -1,43 +1,43 @@
-import { URL, UrlObject } from 'url'
-import { Duplex } from 'stream'
+import { URL, UrlObject } from 'node:url'
+import { Duplex } from 'node:stream'
 import Dispatcher from './dispatcher'
 
-export {
-  request,
-  stream,
-  pipeline,
-  connect,
-  upgrade,
-}
-
 /** Performs an HTTP request. */
-declare function request(
+declare function request<TOpaque = null> (
   url: string | URL | UrlObject,
-  options?: { dispatcher?: Dispatcher } & Omit<Dispatcher.RequestOptions, 'origin' | 'path' | 'method'> & Partial<Pick<Dispatcher.RequestOptions, 'method'>>,
-): Promise<Dispatcher.ResponseData>;
+  options?: { dispatcher?: Dispatcher } & Omit<Dispatcher.RequestOptions<TOpaque>, 'origin' | 'path' | 'method'> & Partial<Pick<Dispatcher.RequestOptions, 'method'>>,
+): Promise<Dispatcher.ResponseData<TOpaque>>
 
 /** A faster version of `request`. */
-declare function stream(
+declare function stream<TOpaque = null> (
   url: string | URL | UrlObject,
-  options: { dispatcher?: Dispatcher } & Omit<Dispatcher.RequestOptions, 'origin' | 'path'>,
-  factory: Dispatcher.StreamFactory
-): Promise<Dispatcher.StreamData>;
+  options: { dispatcher?: Dispatcher } & Omit<Dispatcher.RequestOptions<TOpaque>, 'origin' | 'path'>,
+  factory: Dispatcher.StreamFactory<TOpaque>
+): Promise<Dispatcher.StreamData<TOpaque>>
 
 /** For easy use with `stream.pipeline`. */
-declare function pipeline(
+declare function pipeline<TOpaque = null> (
   url: string | URL | UrlObject,
-  options: { dispatcher?: Dispatcher } & Omit<Dispatcher.PipelineOptions, 'origin' | 'path'>,
-  handler: Dispatcher.PipelineHandler
-): Duplex;
+  options: { dispatcher?: Dispatcher } & Omit<Dispatcher.PipelineOptions<TOpaque>, 'origin' | 'path'>,
+  handler: Dispatcher.PipelineHandler<TOpaque>
+): Duplex
 
 /** Starts two-way communications with the requested resource. */
-declare function connect(
+declare function connect<TOpaque = null> (
   url: string | URL | UrlObject,
-  options?: { dispatcher?: Dispatcher } & Omit<Dispatcher.ConnectOptions, 'origin' | 'path'>
-): Promise<Dispatcher.ConnectData>;
+  options?: { dispatcher?: Dispatcher } & Omit<Dispatcher.ConnectOptions<TOpaque>, 'origin' | 'path'>
+): Promise<Dispatcher.ConnectData<TOpaque>>
 
 /** Upgrade to a different protocol. */
-declare function upgrade(
+declare function upgrade (
   url: string | URL | UrlObject,
   options?: { dispatcher?: Dispatcher } & Omit<Dispatcher.UpgradeOptions, 'origin' | 'path'>
-): Promise<Dispatcher.UpgradeData>;
+): Promise<Dispatcher.UpgradeData>
+
+export {
+  request,
+  stream,
+  pipeline,
+  connect,
+  upgrade
+}

package/node_modules/undici-types/balanced-pool.d.ts

@@ -1,29 +1,30 @@
 import Pool from './pool'
 import Dispatcher from './dispatcher'
-import { URL } from 'url'
+import { URL } from 'node:url'
 
 export default BalancedPool
 
-type BalancedPoolConnectOptions = Omit<Dispatcher.ConnectOptions, "origin">;
+type BalancedPoolConnectOptions = Omit<Dispatcher.ConnectOptions, 'origin'>
 
 declare class BalancedPool extends Dispatcher {
-  constructor(url: string | string[] | URL | URL[], options?: Pool.Options);
+  constructor (url: string | string[] | URL | URL[], options?: Pool.Options)
 
-  addUpstream(upstream: string | URL): BalancedPool;
-  removeUpstream(upstream: string | URL): BalancedPool;
-  upstreams: Array<string>;
+  addUpstream (upstream: string | URL): BalancedPool
+  removeUpstream (upstream: string | URL): BalancedPool
+  getUpstream (upstream: string | URL): Pool | undefined
+  upstreams: Array<string>
 
   /** `true` after `pool.close()` has been called. */
-  closed: boolean;
+  closed: boolean
   /** `true` after `pool.destroyed()` has been called or `pool.close()` has been called and the pool shutdown has completed. */
-  destroyed: boolean;
+  destroyed: boolean
 
   // Override dispatcher APIs.
-  override connect(
+  override connect (
     options: BalancedPoolConnectOptions
-  ): Promise<Dispatcher.ConnectData>;
-  override connect(
+  ): Promise<Dispatcher.ConnectData>
+  override connect (
     options: BalancedPoolConnectOptions,
     callback: (err: Error | null, data: Dispatcher.ConnectData) => void
-  ): void;
+  ): void
 }

package/node_modules/undici-types/cache-interceptor.d.ts

@@ -0,0 +1,179 @@
+import { Readable, Writable } from 'node:stream'
+
+export default CacheHandler
+
+declare namespace CacheHandler {
+  export type CacheMethods = 'GET' | 'HEAD' | 'OPTIONS' | 'TRACE'
+
+  export interface CacheHandlerOptions {
+    store: CacheStore
+
+    cacheByDefault?: number
+
+    type?: CacheOptions['type']
+  }
+
+  export interface CacheOptions {
+    store?: CacheStore
+
+    /**
+     * The methods to cache
+     * Note we can only cache safe methods. Unsafe methods (i.e. PUT, POST)
+     *  invalidate the cache for a origin.
+     * @see https://www.rfc-editor.org/rfc/rfc9111.html#name-invalidating-stored-respons
+     * @see https://www.rfc-editor.org/rfc/rfc9110#section-9.2.1
+     */
+    methods?: CacheMethods[]
+
+    /**
+     * RFC9111 allows for caching responses that we aren't explicitly told to
+     *  cache or to not cache.
+     * @see https://www.rfc-editor.org/rfc/rfc9111.html#section-3-5
+     * @default undefined
+     */
+    cacheByDefault?: number
+
+    /**
+     * TODO docs
+     * @default 'shared'
+     */
+    type?: 'shared' | 'private'
+
+    /**
+     * Array of origins to cache. Only requests to these origins will be cached.
+     * Supports strings (case insensitive) and RegExp patterns.
+     * @default undefined (cache all origins)
+     */
+    origins?: (string | RegExp)[]
+  }
+
+  export interface CacheControlDirectives {
+    'max-stale'?: number;
+    'min-fresh'?: number;
+    'max-age'?: number;
+    's-maxage'?: number;
+    'stale-while-revalidate'?: number;
+    'stale-if-error'?: number;
+    public?: true;
+    private?: true | string[];
+    'no-store'?: true;
+    'no-cache'?: true | string[];
+    'must-revalidate'?: true;
+    'proxy-revalidate'?: true;
+    immutable?: true;
+    'no-transform'?: true;
+    'must-understand'?: true;
+    'only-if-cached'?: true;
+  }
+
+  export interface CacheKey {
+    origin: string
+    method: string
+    path: string
+    headers?: Record<string, string | string[]>
+  }
+
+  export interface CacheValue {
+    statusCode: number
+    statusMessage: string
+    headers: Record<string, string | string[]>
+    vary?: Record<string, string | string[] | null>
+    etag?: string
+    cacheControlDirectives?: CacheControlDirectives
+    cachedAt: number
+    staleAt: number
+    deleteAt: number
+  }
+
+  export interface DeleteByUri {
+    origin: string
+    method: string
+    path: string
+  }
+
+  type GetResult = {
+    statusCode: number
+    statusMessage: string
+    headers: Record<string, string | string[]>
+    vary?: Record<string, string | string[] | null>
+    etag?: string
+    body?: Readable | Iterable<Buffer> | AsyncIterable<Buffer> | Buffer | Iterable<string> | AsyncIterable<string> | string
+    cacheControlDirectives: CacheControlDirectives,
+    cachedAt: number
+    staleAt: number
+    deleteAt: number
+  }
+
+  /**
+   * Underlying storage provider for cached responses
+   */
+  export interface CacheStore {
+    get(key: CacheKey): GetResult | Promise<GetResult | undefined> | undefined
+
+    createWriteStream(key: CacheKey, val: CacheValue): Writable | undefined
+
+    delete(key: CacheKey): void | Promise<void>
+  }
+
+  export interface MemoryCacheStoreOpts {
+    /**
+       * @default Infinity
+       */
+    maxCount?: number
+
+    /**
+     * @default Infinity
+     */
+    maxSize?: number
+
+    /**
+     * @default Infinity
+     */
+    maxEntrySize?: number
+
+    errorCallback?: (err: Error) => void
+  }
+
+  export class MemoryCacheStore implements CacheStore {
+    constructor (opts?: MemoryCacheStoreOpts)
+
+    get (key: CacheKey): GetResult | Promise<GetResult | undefined> | undefined
+
+    createWriteStream (key: CacheKey, value: CacheValue): Writable | undefined
+
+    delete (key: CacheKey): void | Promise<void>
+  }
+
+  export interface SqliteCacheStoreOpts {
+    /**
+     * Location of the database
+     * @default ':memory:'
+     */
+    location?: string
+
+    /**
+     * @default Infinity
+     */
+    maxCount?: number
+
+    /**
+     * @default Infinity
+     */
+    maxEntrySize?: number
+  }
+
+  export class SqliteCacheStore implements CacheStore {
+    constructor (opts?: SqliteCacheStoreOpts)
+
+    /**
+     * Closes the connection to the database
+     */
+    close (): void
+
+    get (key: CacheKey): GetResult | Promise<GetResult | undefined> | undefined
+
+    createWriteStream (key: CacheKey, value: CacheValue): Writable | undefined
+
+    delete (key: CacheKey): void | Promise<void>
+  }
+}

package/node_modules/undici-types/client-stats.d.ts

@@ -0,0 +1,15 @@
+import Client from './client'
+
+export default ClientStats
+
+declare class ClientStats {
+  constructor (pool: Client)
+  /** If socket has open connection. */
+  connected: boolean
+  /** Number of open socket connections in this client that do not have an active request. */
+  pending: number
+  /** Number of currently active requests of this client. */
+  running: number
+  /** Number of active, pending, or queued requests of this client. */
+  size: number
+}