@qqbrowser/openclaw-qbot 0.10.8 → 0.10.10

package/node_modules/axios/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axios",
-  "version": "1.15.1",
+  "version": "1.16.0",
   "description": "Promise based HTTP client for the browser and node.js",
   "main": "./dist/node/axios.cjs",
   "module": "./index.js",
@@ -82,13 +82,13 @@
     "Dmitriy Mozgovoy (https://github.com/DigitalBrainJS)",
     "Nick Uraltsev (https://github.com/nickuraltsev)",
     "Emily Morehouse (https://github.com/emilyemorehouse)",
-    "Justin Beckwith (https://github.com/JustinBeckwith)",
     "Rubén Norte (https://github.com/rubennorte)",
+    "Justin Beckwith (https://github.com/JustinBeckwith)",
     "Martti Laine (https://github.com/codeclown)",
     "Xianming Zhong (https://github.com/chinesedfan)",
-    "Remco Haszing (https://github.com/remcohaszing)",
-    "Shaan Majid (https://github.com/shaanmajid)",
     "Willian Agostini (https://github.com/WillianAgostini)",
+    "Shaan Majid (https://github.com/shaanmajid)",
+    "Remco Haszing (https://github.com/remcohaszing)",
     "Rikki Gibson (https://github.com/RikkiGibson)"
   ],
   "sideEffects": false,
@@ -121,15 +121,15 @@
     "prepare": "husky"
   },
   "dependencies": {
-    "follow-redirects": "^1.15.11",
+    "follow-redirects": "^1.16.0",
     "form-data": "^4.0.5",
     "proxy-from-env": "^2.1.0"
   },
   "devDependencies": {
     "@babel/core": "^7.29.0",
-    "@babel/preset-env": "^7.29.0",
-    "@commitlint/cli": "^20.4.4",
-    "@commitlint/config-conventional": "^20.4.4",
+    "@babel/preset-env": "^7.29.2",
+    "@commitlint/cli": "^20.5.0",
+    "@commitlint/config-conventional": "^20.5.0",
     "@eslint/js": "^10.0.1",
     "@rollup/plugin-alias": "^6.0.0",
     "@rollup/plugin-babel": "^7.0.0",
@@ -137,40 +137,33 @@
     "@rollup/plugin-json": "^6.1.0",
     "@rollup/plugin-node-resolve": "^16.0.3",
     "@rollup/plugin-terser": "^1.0.0",
-    "@vitest/browser": "^4.1.1",
-    "@vitest/browser-playwright": "^4.1.1",
+    "@vitest/browser": "^4.1.5",
+    "@vitest/browser-playwright": "^4.1.5",
     "abortcontroller-polyfill": "^1.7.8",
-    "auto-changelog": "^2.5.0",
     "body-parser": "^2.2.2",
     "chalk": "^5.6.2",
     "cross-env": "^10.1.0",
     "dev-null": "^0.1.1",
-    "eslint": "^10.1.0",
+    "eslint": "^10.2.1",
     "express": "^5.2.1",
     "formdata-node": "^6.0.3",
-    "formidable": "^3.2.4",
+    "formidable": "^3.5.4",
     "fs-extra": "^11.3.4",
     "get-stream": "^9.0.1",
-    "globals": "^17.4.0",
+    "globals": "^17.5.0",
     "gulp": "^5.0.1",
-    "handlebars": "^4.7.8",
     "husky": "^9.1.7",
     "lint-staged": "^16.4.0",
-    "memoizee": "^0.4.17",
     "minimist": "^1.2.8",
     "multer": "^2.1.1",
-    "pacote": "^21.5.0",
-    "playwright": "^1.58.2",
-    "prettier": "^3.8.1",
-    "pretty-bytes": "^7.1.0",
-    "rollup": "^4.60.0",
+    "playwright": "^1.59.1",
+    "prettier": "^3.8.3",
+    "rollup": "^4.60.2",
     "rollup-plugin-bundle-size": "^1.0.3",
     "selfsigned": "^5.5.0",
     "stream-throttle": "^0.1.3",
-    "string-replace-async": "^3.0.2",
-    "tar-stream": "^3.1.8",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.1"
+    "vitest": "^4.1.5"
   },
   "commitlint": {
     "rules": {

package/node_modules/basic-ftp/dist/FtpContext.js

@@ -17,6 +17,8 @@ exports.FTPError = FTPError;
 function doNothing() {
     /** Do nothing */
 }
+// Limit the accepted size of the control response.
+const maxControlResponseLength = 2 ** 16;
 /**
  * FTPContext holds the control and data sockets of an FTP connection and provides a
  * simplified way to interact with an FTP server, handle responses, errors and timeouts.
@@ -275,7 +277,11 @@ class FTPContext {
      */
     _onControlSocketData(chunk) {
         this.log(`< ${chunk}`);
-        // This chunk might complete an earlier partial response.
+        // This chunk might complete an earlier partial response. Protect against unbounded response attack.
+        if (this._partialResponse.length + chunk.length > maxControlResponseLength) {
+            this.closeWithError(new Error("FTP control response exceeded maximum allowed size"));
+            return;
+        }
         const completeResponse = this._partialResponse + chunk;
         const parsed = (0, parseControlResponse_1.parseControlResponse)(completeResponse);
         // Remember any incomplete remainder.

package/node_modules/basic-ftp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "basic-ftp",
-  "version": "5.3.0",
+  "version": "5.3.1",
   "description": "FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript.",
   "main": "dist/index",
   "types": "dist/index",
@@ -42,11 +42,11 @@
     "@eslint/js": "10.0.1",
     "@types/mocha": "10.0.10",
     "@types/node": "25.6.0",
-    "@typescript-eslint/eslint-plugin": "8.58.2",
-    "@typescript-eslint/parser": "8.58.2",
-    "eslint": "10.2.0",
+    "@typescript-eslint/eslint-plugin": "8.59.1",
+    "@typescript-eslint/parser": "8.59.1",
+    "eslint": "10.2.1",
     "globals": "17.5.0",
     "mocha": "11.7.5",
-    "typescript": "6.0.2"
+    "typescript": "6.0.3"
   }
 }

package/node_modules/brace-expansion/dist/commonjs/index.js

@@ -155,7 +155,7 @@ function expand_(str, max, isTop) {
             }
             const pad = n.some(isPadded);
             N = [];
-            for (let i = x; test(i, y); i += incr) {
+            for (let i = x; test(i, y) && N.length < max; i += incr) {
                 let c;
                 if (isAlphaSequence) {
                     c = String.fromCharCode(i);

package/node_modules/brace-expansion/dist/esm/index.js

@@ -151,7 +151,7 @@ function expand_(str, max, isTop) {
             }
             const pad = n.some(isPadded);
             N = [];
-            for (let i = x; test(i, y); i += incr) {
+            for (let i = x; test(i, y) && N.length < max; i += incr) {
                 let c;
                 if (isAlphaSequence) {
                     c = String.fromCharCode(i);

package/node_modules/brace-expansion/package.json

@@ -1,7 +1,7 @@
 {
   "name": "brace-expansion",
   "description": "Brace expansion as known from sh/bash",
-  "version": "5.0.5",
+  "version": "5.0.6",
   "files": [
     "dist"
   ],

package/node_modules/cacheable/dist/index.cjs

@@ -119,8 +119,8 @@ var CacheableSync = class extends import_hookified.Hookified {
     if (this._storage && this._cacheId) {
       const oldSetEvent = this.getPrefixedEvent("cache:set" /* SET */);
       const oldDeleteEvent = this.getPrefixedEvent("cache:delete" /* DELETE */);
-      void this._qified.unsubscribe(oldSetEvent);
-      void this._qified.unsubscribe(oldDeleteEvent);
+      void this._qified.unsubscribeMessage(oldSetEvent);
+      void this._qified.unsubscribeMessage(oldDeleteEvent);
     }
     this._namespace = namespace;
     if (this._storage && this._cacheId) {
@@ -605,14 +605,21 @@ var Cacheable = class extends import_hookified2.Hookified {
    */
   async set(key, value, ttl) {
     let result = false;
-    const finalTtl = (0, import_utils.shorthandToMilliseconds)(ttl ?? this._ttl);
+    const explicitTtl = (0, import_utils.shorthandToMilliseconds)(ttl);
     try {
-      const item = { key, value, ttl: finalTtl };
+      const primaryTtl = (0, import_utils.getCascadingTtl)(
+        this._ttl,
+        this._primary.ttl,
+        explicitTtl
+      );
+      const item = { key, value, ttl: primaryTtl };
       await this.hook("BEFORE_SET" /* BEFORE_SET */, item);
+      const hookOverridden = item.ttl !== primaryTtl;
       const promises = [];
       promises.push(this._primary.set(item.key, item.value, item.ttl));
       if (this._secondary) {
-        promises.push(this._secondary.set(item.key, item.value, item.ttl));
+        const secondaryTtl = hookOverridden ? item.ttl : (0, import_utils.getCascadingTtl)(this._ttl, this._secondary.ttl, explicitTtl);
+        promises.push(this._secondary.set(item.key, item.value, secondaryTtl));
       }
       if (this._nonBlocking) {
         result = await Promise.race(promises);
@@ -948,7 +955,11 @@ var Cacheable = class extends import_hookified2.Hookified {
   async setManyKeyv(keyv, items) {
     const entries = [];
     for (const item of items) {
-      const finalTtl = (0, import_utils.shorthandToMilliseconds)(item.ttl ?? this._ttl);
+      const finalTtl = (0, import_utils.getCascadingTtl)(
+        this._ttl,
+        keyv.ttl,
+        (0, import_utils.shorthandToMilliseconds)(item.ttl)
+      );
       entries.push({ key: item.key, value: item.value, ttl: finalTtl });
     }
     await keyv.setMany(entries);

package/node_modules/cacheable/dist/index.js

@@ -89,8 +89,8 @@ var CacheableSync = class extends Hookified {
     if (this._storage && this._cacheId) {
       const oldSetEvent = this.getPrefixedEvent("cache:set" /* SET */);
       const oldDeleteEvent = this.getPrefixedEvent("cache:delete" /* DELETE */);
-      void this._qified.unsubscribe(oldSetEvent);
-      void this._qified.unsubscribe(oldDeleteEvent);
+      void this._qified.unsubscribeMessage(oldSetEvent);
+      void this._qified.unsubscribeMessage(oldDeleteEvent);
     }
     this._namespace = namespace;
     if (this._storage && this._cacheId) {
@@ -590,14 +590,21 @@ var Cacheable = class extends Hookified2 {
    */
   async set(key, value, ttl) {
     let result = false;
-    const finalTtl = shorthandToMilliseconds(ttl ?? this._ttl);
+    const explicitTtl = shorthandToMilliseconds(ttl);
     try {
-      const item = { key, value, ttl: finalTtl };
+      const primaryTtl = getCascadingTtl(
+        this._ttl,
+        this._primary.ttl,
+        explicitTtl
+      );
+      const item = { key, value, ttl: primaryTtl };
       await this.hook("BEFORE_SET" /* BEFORE_SET */, item);
+      const hookOverridden = item.ttl !== primaryTtl;
       const promises = [];
       promises.push(this._primary.set(item.key, item.value, item.ttl));
       if (this._secondary) {
-        promises.push(this._secondary.set(item.key, item.value, item.ttl));
+        const secondaryTtl = hookOverridden ? item.ttl : getCascadingTtl(this._ttl, this._secondary.ttl, explicitTtl);
+        promises.push(this._secondary.set(item.key, item.value, secondaryTtl));
       }
       if (this._nonBlocking) {
         result = await Promise.race(promises);
@@ -933,7 +940,11 @@ var Cacheable = class extends Hookified2 {
   async setManyKeyv(keyv, items) {
     const entries = [];
     for (const item of items) {
-      const finalTtl = shorthandToMilliseconds(item.ttl ?? this._ttl);
+      const finalTtl = getCascadingTtl(
+        this._ttl,
+        keyv.ttl,
+        shorthandToMilliseconds(item.ttl)
+      );
       entries.push({ key: item.key, value: item.value, ttl: finalTtl });
     }
     await keyv.setMany(entries);

package/node_modules/cacheable/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cacheable",
-  "version": "2.3.4",
+  "version": "2.3.5",
   "description": "High Performance Layer 1 / Layer 2 Caching with Keyv Storage",
   "type": "module",
   "main": "./dist/index.js",
@@ -29,17 +29,17 @@
   "devDependencies": {
     "@keyv/redis": "^5.1.6",
     "@keyv/valkey": "^1.0.11",
-    "@qified/redis": "^0.9.0",
-    "lru-cache": "^11.2.7",
+    "@qified/redis": "^0.10.1",
+    "lru-cache": "^11.3.6",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3"
   },
   "dependencies": {
     "hookified": "^1.15.0",
     "keyv": "^5.6.0",
-    "qified": "^0.9.0",
-    "@cacheable/utils": "^2.4.0",
-    "@cacheable/memory": "^2.0.8"
+    "qified": "^0.10.1",
+    "@cacheable/memory": "^2.0.8",
+    "@cacheable/utils": "^2.4.1"
   },
   "keywords": [
     "cacheable",

package/node_modules/express-rate-limit/dist/index.cjs

@@ -201,6 +201,16 @@ var MemoryStore = class {
 // source/rate-limit.ts
 var import_node_net3 = require("node:net");
 
+// source/console-logger.ts
+var ConsoleLogger = {
+  warn(...args) {
+    console.warn(...args.reverse());
+  },
+  error(...args) {
+    console.error(...args.reverse());
+  }
+};
+
 // source/headers.ts
 var import_node_buffer = require("node:buffer");
 var import_node_crypto = require("node:crypto");
@@ -548,7 +558,8 @@ var validations = {
       validate: true,
       headers: true,
       max: true,
-      passOnStoreError: true
+      passOnStoreError: true,
+      logger: true
     };
     const validOptions = Object.keys(optionsMap).concat(
       "draft_polli_ratelimit_headers",
@@ -661,7 +672,15 @@ var validations = {
     }
   }
 };
-var getValidations = (_enabled) => {
+function validateLogger(logger) {
+  if (typeof logger !== "object" || typeof logger.error !== "function" || typeof logger.warn !== "function") {
+    throw new TypeError(
+      "Provided logger does not implement the Logger interface"
+    );
+  }
+}
+var getValidations = (_enabled, logger) => {
+  validateLogger(logger);
   let enabled;
   if (typeof _enabled === "boolean") {
     enabled = {
@@ -687,8 +706,8 @@ var getValidations = (_enabled) => {
             args
           );
         } catch (error) {
-          if (error instanceof ChangeWarning) console.warn(error);
-          else console.error(error);
+          if (error instanceof ChangeWarning) logger.warn(error);
+          else logger.error(error);
         }
       };
   }
@@ -741,7 +760,11 @@ var getOptionsFromConfig = (config) => {
 };
 var parseOptions = (passedOptions) => {
   const notUndefinedOptions = omitUndefinedProperties(passedOptions);
-  const validations2 = getValidations(notUndefinedOptions?.validate ?? true);
+  const logger = passedOptions.logger ?? ConsoleLogger;
+  const validations2 = getValidations(
+    notUndefinedOptions?.validate ?? true,
+    logger
+  );
   validations2.validationsConfig();
   validations2.knownOptions(passedOptions);
   validations2.draftPolliHeaders(
@@ -816,7 +839,8 @@ var parseOptions = (passedOptions) => {
       notUndefinedOptions.store ?? new MemoryStore(validations2)
     ),
     // Print an error to the console if a few known misconfigurations are detected.
-    validations: validations2
+    validations: validations2,
+    logger
   };
   if (typeof config.store.increment !== "function" || typeof config.store.decrement !== "function" || typeof config.store.resetKey !== "function" || config.store.resetAll !== void 0 && typeof config.store.resetAll !== "function" || config.store.init !== void 0 && typeof config.store.init !== "function") {
     throw new TypeError(
@@ -837,7 +861,24 @@ var rateLimit = (passedOptions) => {
   const options = getOptionsFromConfig(config);
   config.validations.creationStack(config.store);
   config.validations.unsharedStore(config.store);
-  if (typeof config.store.init === "function") config.store.init(options);
+  if (typeof config.store.init === "function") {
+    try {
+      const storeInit = config.store.init(options);
+      if (storeInit instanceof Promise) {
+        storeInit.catch(
+          (error) => config.logger.error(
+            error,
+            "express-rate-limit: async error during store initialization."
+          )
+        );
+      }
+    } catch (error) {
+      config.logger.error(
+        error,
+        "express-rate-limit: error during store initialization."
+      );
+    }
+  }
   const middleware = handleAsyncErrors(
     async (request, response, next) => {
       const closePromise = config.skipFailedRequests && new Promise((resolve) => response.once("close", resolve));
@@ -858,9 +899,9 @@ var rateLimit = (passedOptions) => {
         resetTime = incrementResult.resetTime;
       } catch (error) {
         if (config.passOnStoreError) {
-          console.error(
-            "express-rate-limit: error from store, allowing request without rate-limiting.",
-            error
+          config.logger.error(
+            error,
+            "express-rate-limit: error from store, allowing request without rate-limiting."
           );
           next();
           return;

package/node_modules/express-rate-limit/dist/index.d.cts

@@ -159,6 +159,26 @@ declare const validations: {
 	windowMs(windowMs: number): void;
 };
 export type Validations = typeof validations;
+/**
+ * Basic logging function
+ *
+ * @param error {unknown} - The error to log
+ * @param message {string | undefined} - Additional details about the error
+ */
+export type LoggerFn = (error: unknown, message?: string) => void;
+/**
+ * Minimal interface for logging warnings and errors
+ */
+export type Logger = {
+	/**
+	 * Function to log an error
+	 */
+	error: LoggerFn;
+	/**
+	 * Function to log a warning
+	 */
+	warn: LoggerFn;
+};
 /**
  * Callback that fires when a client's hit counter is incremented.
  *
@@ -265,9 +285,15 @@ export type Store = {
 	 * Method that initializes the store, and has access to the options passed to
 	 * the middleware too.
 	 *
+	 * Called once during initialization.
+	 *
+	 * Errors / promise rejections will be caught and logged.
+	 *
+	 * Note that the result is not awaited - other store methods (such as increment) may be called before init returns and/or after it throws/rejects.
+	 *
 	 * @param options {Options} - The options used to setup the middleware.
 	 */
-	init?: (options: Options) => void;
+	init?: (options: Options) => void | Promise<void>;
 	/**
 	 * Method to fetch a client's hit count and reset time.
 	 *
@@ -477,6 +503,10 @@ export type Options = {
 	 * If the Store generates an error, allow the request to pass.
 	 */
 	passOnStoreError: boolean;
+	/**
+	 * The logger to use to log errors. If absent, logs to the console.
+	 */
+	logger: Logger;
 };
 /**
  * The extended request object that includes information about the client's

package/node_modules/express-rate-limit/dist/index.mjs

@@ -172,6 +172,16 @@ var MemoryStore = class {
 // source/rate-limit.ts
 import { isIPv6 as isIPv62 } from "node:net";
 
+// source/console-logger.ts
+var ConsoleLogger = {
+  warn(...args) {
+    console.warn(...args.reverse());
+  },
+  error(...args) {
+    console.error(...args.reverse());
+  }
+};
+
 // source/headers.ts
 import { Buffer } from "node:buffer";
 import { createHash } from "node:crypto";
@@ -519,7 +529,8 @@ var validations = {
       validate: true,
       headers: true,
       max: true,
-      passOnStoreError: true
+      passOnStoreError: true,
+      logger: true
     };
     const validOptions = Object.keys(optionsMap).concat(
       "draft_polli_ratelimit_headers",
@@ -632,7 +643,15 @@ var validations = {
     }
   }
 };
-var getValidations = (_enabled) => {
+function validateLogger(logger) {
+  if (typeof logger !== "object" || typeof logger.error !== "function" || typeof logger.warn !== "function") {
+    throw new TypeError(
+      "Provided logger does not implement the Logger interface"
+    );
+  }
+}
+var getValidations = (_enabled, logger) => {
+  validateLogger(logger);
   let enabled;
   if (typeof _enabled === "boolean") {
     enabled = {
@@ -658,8 +677,8 @@ var getValidations = (_enabled) => {
             args
           );
         } catch (error) {
-          if (error instanceof ChangeWarning) console.warn(error);
-          else console.error(error);
+          if (error instanceof ChangeWarning) logger.warn(error);
+          else logger.error(error);
         }
       };
   }
@@ -712,7 +731,11 @@ var getOptionsFromConfig = (config) => {
 };
 var parseOptions = (passedOptions) => {
   const notUndefinedOptions = omitUndefinedProperties(passedOptions);
-  const validations2 = getValidations(notUndefinedOptions?.validate ?? true);
+  const logger = passedOptions.logger ?? ConsoleLogger;
+  const validations2 = getValidations(
+    notUndefinedOptions?.validate ?? true,
+    logger
+  );
   validations2.validationsConfig();
   validations2.knownOptions(passedOptions);
   validations2.draftPolliHeaders(
@@ -787,7 +810,8 @@ var parseOptions = (passedOptions) => {
       notUndefinedOptions.store ?? new MemoryStore(validations2)
     ),
     // Print an error to the console if a few known misconfigurations are detected.
-    validations: validations2
+    validations: validations2,
+    logger
   };
   if (typeof config.store.increment !== "function" || typeof config.store.decrement !== "function" || typeof config.store.resetKey !== "function" || config.store.resetAll !== void 0 && typeof config.store.resetAll !== "function" || config.store.init !== void 0 && typeof config.store.init !== "function") {
     throw new TypeError(
@@ -808,7 +832,24 @@ var rateLimit = (passedOptions) => {
   const options = getOptionsFromConfig(config);
   config.validations.creationStack(config.store);
   config.validations.unsharedStore(config.store);
-  if (typeof config.store.init === "function") config.store.init(options);
+  if (typeof config.store.init === "function") {
+    try {
+      const storeInit = config.store.init(options);
+      if (storeInit instanceof Promise) {
+        storeInit.catch(
+          (error) => config.logger.error(
+            error,
+            "express-rate-limit: async error during store initialization."
+          )
+        );
+      }
+    } catch (error) {
+      config.logger.error(
+        error,
+        "express-rate-limit: error during store initialization."
+      );
+    }
+  }
   const middleware = handleAsyncErrors(
     async (request, response, next) => {
       const closePromise = config.skipFailedRequests && new Promise((resolve) => response.once("close", resolve));
@@ -829,9 +870,9 @@ var rateLimit = (passedOptions) => {
         resetTime = incrementResult.resetTime;
       } catch (error) {
         if (config.passOnStoreError) {
-          console.error(
-            "express-rate-limit: error from store, allowing request without rate-limiting.",
-            error
+          config.logger.error(
+            error,
+            "express-rate-limit: error from store, allowing request without rate-limiting."
           );
           next();
           return;

package/node_modules/express-rate-limit/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "express-rate-limit",
-	"version": "8.3.2",
+	"version": "8.5.1",
 	"description": "Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.",
 	"author": {
 		"name": "Nathan Friedly",
@@ -70,11 +70,12 @@
 		"test:lib": "jest",
 		"test:ext": "cd test/external/ && bash run-all-tests",
 		"test": "run-s lint test:lib",
+		"format-test": "run-s format test:lib",
 		"pre-commit": "lint-staged",
 		"prepare": "run-s compile && husky"
 	},
 	"dependencies": {
-		"ip-address": "10.1.0"
+		"ip-address": "^10.2.0"
 	},
 	"peerDependencies": {
 		"express": ">= 4.11"