@rho-workspace/rho 0.5.2 → 0.5.4

package/node_modules/@rho-workspace/plugin-kernel/dist/value-graph.js

@@ -0,0 +1,344 @@
+import { cellLabel, lineage } from './lineage.js';
+import { scriptFlow } from './script-flow.js';
+import { statements } from './statements.js';
+const escaped = (name) => name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const assignment = (name) => new RegExp('^\\s*`?' + escaped(name) + '`?\\s*(?::[^=\\n]*)?(?:<<-|<-|=(?!=))\\s*');
+// What the statement that assigns a name gives it, as text.
+function assigned(code, name, language) {
+    const lines = code.split('\n'), re = assignment(name);
+    for (const s of statements(code, language)) {
+        const m = re.exec(lines[s.from - 1]);
+        if (m)
+            return [lines[s.from - 1].slice(m[0].length), ...lines.slice(s.from, s.to)].join('\n').trim();
+    }
+    return null;
+}
+// One line on how a value is made: what its assignment gives it, else the statement's first line.
+function howOf(code, name, language) {
+    const first = (code.split('\n').find(l => l.trim() && !/^\s*#/.test(l)) ?? '').trim();
+    const rest = assigned(code, name, language);
+    if (rest === null) {
+        const def = language === 'python' && code.split('\n').find(l => new RegExp('^\\s*(?:async\\s+)?def\\s+' + escaped(name) + '\\b').test(l));
+        return def ? def.trim().replace(/:\s*$/, '') : first;
+    }
+    if (/^(?:function\s*\(|\\\()/.test(rest))
+        return 'function' + (rest.match(/\([^)]*\)/)?.[0] ?? '()');
+    return rest.split('\n').map(l => l.trim()).join(' ');
+}
+// Where in a step that makes several values one of them is made: the statement that assigns it,
+// else the whole step.
+function narrowed(making, name, language) {
+    const lines = making.code.split('\n'), re = assignment(name);
+    for (const s of statements(making.code, language))
+        if (re.test(lines[s.from - 1]))
+            return { ...making, from: making.from + s.from - 1, to: making.from + s.to - 1, code: lines.slice(s.from - 1, s.to).join('\n') };
+    return making;
+}
+// The line that names a file, else the statement's first line.
+const howFile = (code, path) => code.split('\n').find(l => l.includes(path))?.trim() ?? (code.split('\n').find(l => l.trim() && !/^\s*#/.test(l)) ?? '').trim();
+// A constant: its assignment gives it only literals, and calls that are given only literals and do
+// not read anything (c(), paste0(), theme(), dict(); not read.csv() of a URL).
+const literalNames = new Set(['TRUE', 'FALSE', 'T', 'F', 'NULL', 'NA', 'Inf', 'NaN', 'pi', 'LETTERS', 'letters', 'month.name', 'month.abb', 'True', 'False', 'None']);
+const fetches = /read|load|fetch|download|scan|query|import|open|connect|request|url|get$|^get|^data$|^source$/i;
+function literal(code, name, language) {
+    const rest = assigned(code, name, language);
+    if (rest === null)
+        return false;
+    const plain = rest.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, '""').replace(/#.*$/gm, '');
+    for (const w of plain.matchAll(/([\p{L}_.][\p{L}\p{N}_.]*)\s*(\(|=(?!=))?/gu)) {
+        if (/^\.?\d/.test(w[1]) || w[2] === '=' || (w[2] === '(' ? !fetches.test(w[1]) : literalNames.has(w[1])))
+            continue;
+        return false;
+    }
+    return true;
+}
+function builder(language) {
+    const nodes = new Map();
+    const node = (id, kind, name, how) => {
+        let n = nodes.get(id);
+        if (!n)
+            nodes.set(id, n = { id, kind, name, how, made: [], uses: [], parents: [], children: [], fn: false, language });
+        else if (how && !n.how)
+            n.how = how;
+        return n;
+    };
+    const make = (id, kind, name, making, how, parents, fn = false, stale = []) => {
+        const n = node(id, kind, name, how);
+        if (stale.length)
+            n.stale = [...new Set([...n.stale ?? [], ...stale])];
+        if (making && !n.made.some(m => m.from === making.from && m.cell?.cellId === making.cell?.cellId))
+            n.made.push(making);
+        if (fn)
+            n.fn = true;
+        for (const p of parents) {
+            if (p === id || n.parents.includes(p))
+                continue;
+            n.parents.push(p);
+            if (p.startsWith('in:'))
+                node(p, 'input', p.slice(3), '');
+        }
+    };
+    // What the code says a node is: the first meaning given, where it has none yet.
+    const means = (id, text) => { const n = nodes.get(id); if (n && text && !n.means)
+        n.means = text; };
+    const finish = (rest) => {
+        for (const n of nodes.values())
+            n.parents = n.parents.filter(p => nodes.has(p));
+        const relink = () => {
+            for (const n of nodes.values())
+                n.children = [];
+            for (const n of nodes.values())
+                for (const p of n.parents)
+                    nodes.get(p).children.push(n.id);
+        };
+        relink();
+        // Functions and constants something uses become what its users use.
+        const folded = new Map();
+        const gone = new Set([...nodes.values()].filter(n => n.kind === 'value' && n.children.length > 0
+            && (n.fn || (n.parents.length === 0 && n.made.length === 1 && literal(n.made[0].code, n.name, n.language)))).map(n => n.id));
+        const expand = (ids, seen = new Set()) => {
+            const parents = [], uses = [];
+            for (const id of ids) {
+                if (!gone.has(id)) {
+                    parents.push(id);
+                    continue;
+                }
+                if (seen.has(id))
+                    continue;
+                seen.add(id);
+                const n = nodes.get(id), inner = expand(n.parents, seen);
+                uses.push(n.name, ...inner.uses);
+                parents.push(...inner.parents);
+            }
+            return { parents, uses };
+        };
+        for (const n of nodes.values()) {
+            if (gone.has(n.id))
+                continue;
+            const { parents, uses } = expand(n.parents);
+            n.parents = [...new Set(parents)].filter(p => p !== n.id);
+            n.uses = [...new Set([...n.uses, ...uses])];
+        }
+        for (const id of gone) {
+            const n = nodes.get(id);
+            folded.set(n.name, { made: n.made, means: n.means });
+            nodes.delete(id);
+        }
+        relink();
+        // A value made from one other and used only to change it is part of that one.
+        for (let again = true; again;) {
+            again = false;
+            for (const v of nodes.values()) {
+                if (v.kind !== 'value' || v.children.length !== 1)
+                    continue;
+                const t = nodes.get(v.children[0]);
+                if (t.kind !== 'value' || !v.parents.length || !v.parents.every(p => p === t.id))
+                    continue;
+                t.uses = [...new Set([...t.uses, v.name, ...v.uses])];
+                t.parents = t.parents.filter(p => p !== v.id);
+                folded.set(v.name, { made: v.made, means: v.means });
+                nodes.delete(v.id);
+                relink();
+                again = true;
+                break;
+            }
+        }
+        const all = [...nodes.values()];
+        const made = all.filter(n => n.kind === 'output' || n.kind === 'plot').map(n => n.id);
+        const ends = all.filter(n => n.kind === 'value' && !n.children.length).map(n => n.id);
+        const results = made.length ? made : ends;
+        const behind = new Set();
+        const up = (id) => { if (behind.has(id))
+            return; behind.add(id); for (const p of nodes.get(id).parents)
+            up(p); };
+        for (const r of results)
+            up(r);
+        return { nodes: new Map(all.map(({ fn: _, language: __, ...n }) => [n.id, n])), results, inputs: all.filter(n => n.kind === 'input').map(n => n.id),
+            others: all.filter(n => !behind.has(n.id)).map(n => n.id), folded, ...rest };
+    };
+    return { make, means, finish };
+}
+// A script read as text: each step makes its values and the files it writes, from what the step
+// reads.
+export function scriptGraph(flow, language) {
+    const b = builder(language);
+    const idOf = (link) => (link.startsWith('wrote:') ? 'out:' : 'v:') + link.slice(6).replace(/@\d+$/, '');
+    for (const step of flow.steps) {
+        const making = { from: step.from, to: step.to, code: step.cell.code };
+        const parents = [...flow.links.filter(l => l.to === step.id).map(l => idOf(l.from)), ...step.reads.map(p => 'in:' + p)];
+        for (const n of step.nodes) {
+            const file = n.kind === 'file', own = step.nodes.length > 1 && !file ? narrowed(making, n.name, language) : making, id = (file ? 'out:' : 'v:') + n.name;
+            b.make(id, file ? 'output' : 'value', n.name, own, file ? howFile(step.cell.code, n.name) : howOf(step.cell.code, n.name, language), parents, step.functions.includes(n.name));
+            b.means(id, flow.means.get((file ? 'file:' : 'value:') + n.name));
+        }
+        for (const p of step.reads)
+            b.means('in:' + p, flow.means.get('file:' + p));
+    }
+    return b.finish(flow);
+}
+export function sessionGraph(cells, values, language) {
+    const graph = lineage(cells, values.map(v => v.name)), b = builder(language);
+    // What an earlier cell's code says its values are, read once per cell.
+    const meaningsOfCell = new Map();
+    const meanOfCell = (c) => { if (!meaningsOfCell.has(c.cellId))
+        meaningsOfCell.set(c.cellId, scriptFlow(c.code, language).means); return meaningsOfCell.get(c.cellId); };
+    const functions = new Set(values.filter(v => v.type === 'function' || v.type === 'closure').map(v => v.name));
+    const written = new Set(graph.steps.flatMap(s => s.nodes.filter(n => n.id.startsWith('wrote:')).map(n => n.name)));
+    const fileNode = (path) => (written.has(path) ? 'out:' : 'in:') + path;
+    const idOf = (link) => (link.startsWith('wrote:') ? 'out:' : 'v:') + link.slice(6);
+    for (const step of graph.steps) {
+        if (!step.cell) {
+            for (const n of step.nodes)
+                b.make('v:' + n.name, 'input', n.name, null, 'Already in the session', []);
+            continue;
+        }
+        const cell = step.cell, where = (c) => ({ cellId: c.cellId, number: c.number, label: cellLabel(c) });
+        const whole = (c) => ({ from: 1, to: c.code.split('\n').length, code: c.code, cell: where(c) });
+        const into = [...graph.links.filter(l => l.to === step.id).map(l => idOf(l.from)), ...step.reads.map(fileNode)];
+        const current = new Set(step.nodes.map(n => n.name));
+        const flow = scriptFlow(cell.code, cell.language, undefined, cell.used ?? []);
+        const stepOf = (link) => flow.steps.find(s => s.id === 'lines:' + link.slice(link.lastIndexOf('@') + 1));
+        // What a statement read: the session's values and files as the record has them, and what the
+        // statements before it made, through what this cell made that the session no longer holds.
+        const partsOf = (s, seen = new Set()) => {
+            if (seen.has(s.id))
+                return [];
+            seen.add(s.id);
+            return [...flow.links.filter(l => l.to === s.id).flatMap(l => {
+                    const name = l.from.slice(6).replace(/@\d+$/, ''), before = stepOf(l.from);
+                    return l.from.startsWith('wrote:') ? [fileNode(name)] : current.has(name) ? ['v:' + name] : before ? partsOf(before, seen) : [];
+                }), ...flow.outside.filter(o => o.to === s.id).map(o => 'v:' + o.name).filter(id => into.includes(id)), ...s.reads.map(fileNode)];
+        };
+        const own = new Map(), key = (kind, name) => (kind === 'file' ? 'f:' : 'v:') + name;
+        if (flow.steps.length > 1)
+            for (const s of flow.steps)
+                for (const n of s.nodes)
+                    own.set(key(n.kind, n.name), [...own.get(key(n.kind, n.name)) ?? [], s]);
+        const seen = new Set([...own.values()].flat().flatMap(s => partsOf(s)));
+        const unseen = into.filter(id => !seen.has(id)), readInCell = new Set(flow.links.map(l => l.from));
+        const ends = [];
+        for (const n of step.nodes) {
+            if (n.kind === 'plot')
+                continue;
+            const kind = n.kind === 'value' ? 'value' : 'output', id = (kind === 'value' ? 'v:' : 'out:') + n.name, meant = flow.means.get((kind === 'value' ? 'value:' : 'file:') + n.name);
+            const steps = own.get(key(n.kind, n.name));
+            for (const c of step.earlier)
+                if (c.defined?.includes(n.name)) {
+                    b.make(id, kind, n.name, whole(c), kind === 'value' ? howOf(c.code, n.name, cell.language) : howFile(c.code, n.name), []);
+                    b.means(id, meanOfCell(c).get('value:' + n.name));
+                }
+            if (steps) {
+                const first = steps[0], last = steps.at(-1), how = kind === 'value' ? howOf(first.cell.code, n.name, cell.language) : howFile(first.cell.code, n.name);
+                for (const s of steps) {
+                    const making = { from: s.from, to: s.to, code: s.cell.code, cell: where(cell) };
+                    b.make(id, kind, n.name, s.nodes.length > 1 && kind === 'value' ? narrowed(making, n.name, cell.language) : making, how, [...partsOf(s), ...unseen], functions.has(n.name) || s.functions.includes(n.name), step.stale);
+                }
+                b.means(id, meant);
+                if (kind === 'value' && !readInCell.has(`value:${n.name}@${last.from}`))
+                    ends.push(id);
+            }
+            else {
+                const how = flow.steps.length === 1 ? (kind === 'value' ? howOf(cell.code, n.name, cell.language) : howFile(cell.code, n.name)) : cell.purpose ?? cellLabel(cell);
+                b.make(id, kind, n.name, whole(cell), how, into, functions.has(n.name), step.stale);
+                b.means(id, meant);
+                if (kind === 'value')
+                    ends.push(id);
+            }
+        }
+        for (const p of step.reads)
+            b.means(fileNode(p), flow.means.get('file:' + p));
+        // A plot comes from what the statements that make nothing read (plot(fit), print(p); not rm()
+        // or a check), as the statements before them made it; else from what the cell made last, else
+        // what it read.
+        const lines = cell.code.split('\n');
+        const drawing = flow.quietReads.filter(q => !/^\s*(?:rm|remove|del|stopifnot|assert|message|cat|warning|stop)\b/.test(lines[q.from - 1] ?? '')).map(q => ({ ...q, parts: q.used.flatMap(name => {
+                const before = [...flow.steps].reverse().find(s => s.from < q.from && s.nodes.some(n => n.kind === 'value' && n.name === name));
+                return !before ? (into.includes('v:' + name) ? ['v:' + name] : []) : current.has(name) ? ['v:' + name] : partsOf(before);
+            }) })).filter(q => q.parts.length);
+        for (const n of step.nodes)
+            if (n.kind === 'plot') {
+                b.make(n.id, 'plot', `${n.name} · ${cell.language === 'r' ? 'R' : 'Python'} ${cell.number}`, whole(cell), drawing.length ? lines.slice(drawing.at(-1).from - 1, drawing.at(-1).to).join(' ').trim() : cell.purpose ?? cellLabel(cell), drawing.length ? drawing.flatMap(q => q.parts) : ends.length ? ends : into, false, step.stale);
+                b.means(n.id, drawing.at(-1)?.means);
+            }
+    }
+    // The newest results first.
+    const done = b.finish({ quiet: 0, cut: 0, tooLong: false }), ran = (id) => Math.max(0, ...done.nodes.get(id).made.map(m => m.cell?.number ?? 0));
+    return { ...done, results: [...done.results].sort((x, y) => ran(y) - ran(x)), omitted: graph.omitted };
+}
+// What a node comes from and what comes of it, each holding the node.
+export function graphPath(graph, id) {
+    const reach = (next) => {
+        const seen = new Set([id]), queue = [id];
+        while (queue.length)
+            for (const o of next(graph.nodes.get(queue.pop())))
+                if (!seen.has(o) && graph.nodes.has(o)) {
+                    seen.add(o);
+                    queue.push(o);
+                }
+        return seen;
+    };
+    return { up: reach(n => n.parents), down: reach(n => n.children) };
+}
+// Rows from the data down: a node sits one row below the lowest of what it comes from; within a
+// row, nodes sit near the middle of what they come from, else in the order they were made.
+export function graphRows(graph, shown) {
+    const depth = new Map(), visiting = new Set();
+    const parents = (id) => graph.nodes.get(id).parents.filter(p => shown.has(p));
+    const rowOf = (id) => {
+        if (depth.has(id))
+            return depth.get(id);
+        if (visiting.has(id))
+            return 0;
+        visiting.add(id);
+        const d = Math.max(-1, ...parents(id).map(rowOf)) + 1;
+        visiting.delete(id);
+        depth.set(id, d);
+        return d;
+    };
+    const at = (n) => n.made[0] ? (n.made[0].cell?.number ?? 0) * 1e5 + n.made[0].from : -1;
+    const ordered = [...shown].map(id => graph.nodes.get(id)).sort((a, b) => at(a) - at(b) || a.name.localeCompare(b.name));
+    const rows = [];
+    for (const n of ordered)
+        (rows[rowOf(n.id)] ??= []).push(n.id);
+    const kept = rows.filter(Boolean), place = new Map();
+    kept.forEach(row => row.forEach((id, i) => place.set(id, i / Math.max(1, row.length - 1))));
+    for (const row of kept.slice(1)) {
+        const middle = (id) => { const ps = parents(id).map(p => place.get(p)); return ps.length ? ps.reduce((s, x) => s + x, 0) / ps.length : place.get(id); };
+        row.sort((a, b) => middle(a) - middle(b));
+        row.forEach((id, i) => place.set(id, i / Math.max(1, row.length - 1)));
+    }
+    return kept;
+}
+export function graphMarks(graph, id) {
+    const node = graph.nodes.get(id);
+    if (!node)
+        return [];
+    const { up, down } = graphPath(graph, id), out = [];
+    const add = (kind, made) => { for (const m of made)
+        out.push({ ...m, kind }); };
+    add('here', node.made);
+    for (const n of up) {
+        const u = graph.nodes.get(n);
+        if (n !== id)
+            add('from', u.made);
+        for (const use of u.uses)
+            add('from', graph.folded.get(use)?.made ?? []);
+    }
+    for (const n of down)
+        if (n !== id)
+            add('into', graph.nodes.get(n).made);
+    return out;
+}
+// The node made at a line (of a cell's code, when it names one), if any: of those, the one made in
+// the fewest lines there.
+export function graphNodeAt(graph, line, cellId) {
+    let best = null, span = Infinity;
+    for (const n of graph.nodes.values())
+        for (const m of n.made) {
+            if (m.cell?.cellId !== cellId || line < m.from || line > m.to || m.to - m.from >= span)
+                continue;
+            best = n;
+            span = m.to - m.from;
+        }
+    return best;
+}

package/node_modules/@rho-workspace/plugin-kernel/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rho-workspace/plugin-kernel",
-  "version": "0.5.2",
+  "version": "0.5.5",
   "type": "module",
   "description": "Rho live session plugin: an R and a Python session the Agent and the person run code in, kept with each cell's output, plots and the session's variables",
   "license": "AGPL-3.0-only",

package/node_modules/@rho-workspace/plugin-kernel/runners/runner.R

@@ -98,11 +98,14 @@ lineage_of <- function(code) {
   list(mentioned = unique(words), assigned = unique(assigned), strings = unique(substring(quoted, 2, nchar(quoted) - 1)))
 }
 # The strings that name a place in the project, each as its project path, with the file's or
-# folder's size and time before the cell. A path outside the project is not followed.
+# folder's size and time before the cell. A path outside the project is not followed. At most
+# `most` strings are looked at; those that look like a file's path (a folder or an extension)
+# come first, so a script's many labels do not crowd out the file it writes at its end.
 project_paths <- function(strings, most = 32L) {
   # Paths are compared with / as their separator, which Windows also takes (C:/data/x.csv).
   root <- normalizePath(getwd(), winslash = "/")
-  s <- utils::head(strings[nchar(strings) > 0 & nchar(strings) < 512 & !grepl("[\n\r\t]", strings)], most)
+  s <- strings[nchar(strings) > 0 & nchar(strings) < 512 & !grepl("[\n\r\t]", strings)]
+  s <- utils::head(s[order(!grepl("/|\\.[A-Za-z][A-Za-z0-9]{0,7}$", s))], most)
   out <- list()
   for (p in s) {
     full <- if (grepl("^(/|~|[A-Za-z]:[/\\\\])", p)) path.expand(p) else file.path(root, p)
@@ -378,7 +381,7 @@ inspect <- function(msg) {
      error = function(e) reply(list(state = "failed", problem = conditionMessage(e))))
 }
 
-emit(list(kind = "ready", version = R.version.string, pid = Sys.getpid(), host = Sys.info()[["nodename"]], folder = getwd(), variables = variables(200)))
+emit(list(kind = "ready", version = R.version.string, executable = file.path(R.home("bin"), if (.Platform$OS.type == "windows") "Rscript.exe" else "Rscript"), pid = Sys.getpid(), host = Sys.info()[["nodename"]], folder = getwd(), variables = variables(200)))
 repeat {
   line <- tryCatch(readLines(input, n = 1), interrupt = function(e) NA)
   if (identical(line, NA)) next

package/node_modules/@rho-workspace/plugin-kernel/runners/runner.py

@@ -4,7 +4,7 @@
 # that value, as a notebook does. Figures made with matplotlib are saved after each cell. An
 # interrupt (SIGINT; on Windows a Ctrl+C or Ctrl+Break on the session's console) stops the cell
 # that is running and leaves the session and its variables.
-import ast, base64, io, json, linecache, os, platform, signal, sys, tempfile, traceback, types
+import ast, base64, io, json, linecache, os, platform, re, signal, sys, tempfile, traceback, types
 
 root = sys.argv[1]
 os.chdir(root)
@@ -174,9 +174,12 @@ def stamp(path):
         return ('folder', info.st_mtime_ns) if os.path.isdir(path) else (info.st_size, info.st_mtime_ns)
     except OSError: return None
 
+# At most `most` strings are looked at; those that look like a file's path (a folder or an
+# extension) come first, so a script's many labels do not crowd out the file it writes at its end.
 def project_paths(strings, most=32):
     root, out = os.path.realpath(os.getcwd()), {}
-    for text in [t for t in strings if 0 < len(t) < 512 and not any(c in t for c in '\n\r\t')][:most]:
+    kept = [t for t in strings if 0 < len(t) < 512 and not any(c in t for c in '\n\r\t')]
+    for text in sorted(kept, key=lambda t: not re.search(r'/|\.[A-Za-z][A-Za-z0-9]{0,7}$', t))[:most]:
         full = os.path.expanduser(text) if text.startswith(('/', '~')) else os.path.join(root, text)
         # The folder may not be there yet: one the cell makes before it writes into it.
         folder = os.path.realpath(os.path.dirname(full))
@@ -442,7 +445,7 @@ def inspect_value(msg):
     except Exception as error:
         reply({'state': 'failed', 'problem': f'{type(error).__name__}: {error}'})
 
-emit({'kind': 'ready', 'version': 'Python ' + sys.version.split()[0], 'pid': os.getpid(), 'host': platform.node(), 'folder': os.getcwd(), 'variables': variables(200)})
+emit({'kind': 'ready', 'version': 'Python ' + sys.version.split()[0], 'executable': sys.executable, 'pid': os.getpid(), 'host': platform.node(), 'folder': os.getcwd(), 'variables': variables(200)})
 while True:
     try:
         line = requests.readline()

package/node_modules/express-rate-limit/dist/index.cjs

@@ -1061,7 +1061,7 @@ var rateLimit = (passedOptions) => {
           const retryAfter = await retrieveRetryAfter;
           setRetryAfterHeader(response, info, config.windowMs, retryAfter);
         }
-        config.handler(request, response, next, options);
+        await config.handler(request, response, next, options);
         return;
       }
       next();

package/node_modules/express-rate-limit/dist/index.mjs

@@ -1018,7 +1018,7 @@ var rateLimit = (passedOptions) => {
           const retryAfter = await retrieveRetryAfter;
           setRetryAfterHeader(response, info, config.windowMs, retryAfter);
         }
-        config.handler(request, response, next, options);
+        await config.handler(request, response, next, options);
         return;
       }
       next();

package/node_modules/express-rate-limit/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "express-rate-limit",
-	"version": "8.7.2",
+	"version": "8.7.3",
 	"description": "Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.",
 	"author": {
 		"name": "Nathan Friedly",

package/node_modules/ip-address/dist/ipv6.js

@@ -733,7 +733,7 @@ class Address6 {
         address = this.parse4in6(address);
         const badCharacters = address.match(constants6.RE_BAD_CHARACTERS);
         if (badCharacters) {
-            throw new address_error_1.AddressError(`Bad character${badCharacters.length > 1 ? 's' : ''} detected in address: ${badCharacters.join('')}`, address.replace(constants6.RE_BAD_CHARACTERS, '<span class="parse-error">$1</span>'));
+            throw new address_error_1.AddressError(`Bad character${badCharacters.length > 1 ? 's' : ''} detected in address: ${badCharacters.join('')}`, address.replace(constants6.RE_BAD_CHARACTERS, (character) => `<span class="parse-error">${helpers.escapeHtml(character)}</span>`));
         }
         const badAddress = address.match(constants6.RE_BAD_ADDRESS);
         if (badAddress) {

package/node_modules/ip-address/package.json

@@ -16,7 +16,7 @@
     "bigint",
     "browser"
   ],
-  "version": "10.7.5",
+  "version": "10.7.6",
   "author": "Beau Gunderson <beau@beaugunderson.com> (https://beaugunderson.com/)",
   "license": "MIT",
   "main": "dist/ip-address.js",