@sap/cds-dk 10.2.0 → 10.2.1

package/node_modules/on-finished/index.js

@@ -65,10 +65,11 @@ function onFinished (msg, listener) {
 
 function isFinished (msg) {
   var socket = msg.socket
+  var finished = writableEnded(msg)
 
-  if (typeof msg.finished === 'boolean') {
+  if (typeof finished === 'boolean') {
     // OutgoingMessage
-    return Boolean(msg.finished || (socket && !socket.writable))
+    return Boolean(finished || (socket && !socket.writable))
   }
 
   if (typeof msg.complete === 'boolean') {
@@ -232,3 +233,14 @@ function wrap (fn) {
   // return bound function
   return res.runInAsyncScope.bind(res, fn, null)
 }
+
+/**
+ * Determines if a writable stream has finished.
+ *
+ * @param {Object} res
+ * @returns {boolean}
+ * @private
+ */
+function writableEnded (res) {
+  return typeof res.writableEnded === 'boolean' ? res.writableEnded : res.finished
+}

package/node_modules/on-finished/package.json

@@ -1,38 +1,42 @@
 {
   "name": "on-finished",
   "description": "Execute a callback when a request closes, finishes, or errors",
-  "version": "2.4.1",
+  "version": "2.4.2",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)"
   ],
   "license": "MIT",
   "repository": "jshttp/on-finished",
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
+  },
+  "type": "commonjs",
   "dependencies": {
     "ee-first": "1.1.1"
   },
   "devDependencies": {
-    "eslint": "7.32.0",
+    "eslint": "8.17.0",
     "eslint-config-standard": "14.1.1",
-    "eslint-plugin-import": "2.25.4",
+    "eslint-plugin-import": "2.26.0",
     "eslint-plugin-markdown": "2.2.1",
     "eslint-plugin-node": "11.1.0",
-    "eslint-plugin-promise": "5.2.0",
+    "eslint-plugin-promise": "6.0.0",
     "eslint-plugin-standard": "4.1.0",
-    "mocha": "9.2.1",
+    "mocha": "12.0.3",
     "nyc": "15.1.0"
   },
   "engines": {
     "node": ">= 0.8"
   },
   "files": [
-    "HISTORY.md",
     "LICENSE",
     "index.js"
   ],
   "scripts": {
     "lint": "eslint .",
-    "test": "mocha --reporter spec --bail --check-leaks test/",
+    "test": "mocha --reporter spec --check-leaks test/",
     "test-ci": "nyc --reporter=lcovonly --reporter=text npm test",
     "test-cov": "nyc --reporter=html --reporter=text npm test"
   }

package/node_modules/qs/.editorconfig

@@ -39,7 +39,7 @@ indent_style = off
 indent = off
 max_line_length = off
 
-[.nycrc]
+[{.nycrc,*.mjs}]
 indent_style = tab
 
 [tea.yaml]

package/node_modules/qs/CHANGELOG.md

@@ -1,26 +1,64 @@
+## **6.17.1**
+- [Fix] `parse`: `interpretNumericEntities`: decode code points above U+FFFF as surrogate pairs (#640)
+- [Fix] `parse`: respect `plainObjects` for `[]` with `parseArrays: false` (#639)
+- [Fix] `utils`: `merge`: count the elements of a sparse array against `arrayLimit`, not its holes
+- [Fix] `parse`: guard bracket-wrapped prototype keys at depth 0 (#638)
+- [Refactor] `parse`: extract wrapping-bracket stripping helper
+- [readme] document that `depth: 0` and `depth: false` keep keys flat
+- [Tests] `parse`: pin depth-0 bracket stripping and prototype keys kept by `allowPrototypes`/`plainObjects`
+
+## **6.17.0**
+- [New] `stringify`: add `WHATWG` format (#623)
+- [Fix] `stringify`: do not sort the caller's `filter` array in place (#637)
+- [Fix] `parse`: copy an own `__proto__` key as data (#636)
+- [Fix] `parse`: decode percent-encoded dots case-insensitively (#635)
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [Fix] `parse`: preserve comma arrays when interpreting numeric entities (#630)
+- [Fix] `parse`: allow scalar fields with a zero array limit (#627)
+- [Fix] `parse`: do not count an existing comma array toward `arrayLimit` when `duplicates` discards or replaces it
+- [Fix] `utils`: `encode`: encode lone surrogates as U+FFFD instead of consuming the next code unit (#624)
+- [eslint] fix indentation
+- [readme] document the encoder's `format` argument
+- [meta] add changelog acknowledgement
+- [meta] fix changelog indents
+- [Dev Deps] update `eslint`, `evalmd`, `npmignore`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
+- [Tests] `stringify`: pin `sort` order for nested keys selected by an array `filter`
+- [Tests] `parse`: cover `interpretNumericEntities` across value shapes, keys, and the charset sentinel
+- [Tests] `parse`: cover more input that builds no array at a zero or negative `arrayLimit`
+- [Tests] `parse`: cover `comma` with a zero or negative `arrayLimit`, and combining a full comma array
+- [Tests] `parse`: pin the behavior of a zero or negative `arrayLimit`
+- [Tests] `utils`/`stringify`: pin `~`, `*`, and parens encoding in RFC3986 and RFC1738
+
+## **6.16.2**
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [meta] use double quotes for better OS support
+- [Dev Deps] update `evalmd`, `npmignore`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
+
 ## **6.16.1**
- - [Fix] `parse`: do not mutate an object input
- - [Fix] `stringify`: stop re-encoding structural separator dots when `encodeDotInKeys` is set (#564)
- - [Fix] `stringify`: `arrayFormat: 'comma'`: pass the full encoder arguments with `encodeValuesOnly`
- - [Fix] `utils`: encode `+` as `%2B` in iso-8859-1 mode so values round-trip (#565)
- - [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
- - [Fix] `stringify`: ignore inherited array format names (#622)
- - [Fix] `stringify`: `arrayFormat: 'comma'`: do not throw on elements with no callable `toString`
- - [Fix] `utils`: `merge`: seed an overflow container's index from its own keys, not just the source
- - [Fix] `utils`: `merge`: keep a `strictMerge` conflict container's index and `arrayLimit` correct
- - [Fix] `parse`: only treat `[]` as array syntax when it ends the key
- - [Perf] `decode`: skip decoders when there is no percent sign (#583)
- - [Robustness] `utils`: `merge`: apply `arrayLimit` to the two-element array built for colliding values
- - [Robustness] `parse`: bound the nesting added by repeated `strictMerge` conflicts
- - [Docs] document that `qs` and flat parsers disagree about parameter names
- - [Docs] clarify that `throwOnLimitExceeded` limits each array, not the total number of values
- - [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
- - [meta] fix changelog indents
- - [actions] set least-privilege `cache-mode`
- - [Tests] `utils`: `decode`: add missing cases
- - [Tests] `parse`: characterize the `]=` split when an `=` precedes any bracket group (#620)
- - [Tests] `parse`: `allowDots`: cover stray close brackets before a dot
- - [Dev Deps] update `@ljharb/eslint-config`, `eslint`, `tape`
+- [Fix] `parse`: do not mutate an object input
+- [Fix] `stringify`: stop re-encoding structural separator dots when `encodeDotInKeys` is set (#564)
+- [Fix] `stringify`: `arrayFormat: 'comma'`: pass the full encoder arguments with `encodeValuesOnly`
+- [Fix] `utils`: encode `+` as `%2B` in iso-8859-1 mode so values round-trip (#565)
+- [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
+- [Fix] `stringify`: ignore inherited array format names (#622)
+- [Fix] `stringify`: `arrayFormat: 'comma'`: do not throw on elements with no callable `toString`
+- [Fix] `utils`: `merge`: seed an overflow container's index from its own keys, not just the source
+- [Fix] `utils`: `merge`: keep a `strictMerge` conflict container's index and `arrayLimit` correct
+- [Fix] `parse`: only treat `[]` as array syntax when it ends the key
+- [Perf] `decode`: skip decoders when there is no percent sign (#583)
+- [Robustness] `utils`: `merge`: apply `arrayLimit` to the two-element array built for colliding values
+- [Robustness] `parse`: bound the nesting added by repeated `strictMerge` conflicts (credit @Yeaseen)
+- [Docs] document that `qs` and flat parsers disagree about parameter names
+- [Docs] clarify that `throwOnLimitExceeded` limits each array, not the total number of values
+- [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
+- [meta] fix changelog indents
+- [actions] set least-privilege `cache-mode`
+- [Tests] `utils`: `decode`: add missing cases
+- [Tests] `parse`: characterize the `]=` split when an `=` precedes any bracket group (#620)
+- [Tests] `parse`: `allowDots`: cover stray close brackets before a dot
+- [Dev Deps] update `@ljharb/eslint-config`, `eslint`, `tape`
 
 ## **6.16.0**
 - [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
@@ -37,6 +75,12 @@
 - [Dev Deps] update `@ljharb/eslint-config`, `eslint`
 - [Dev Deps] update `eslint`, `evalmd`
 
+## **6.15.4**
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [meta] use double quotes for better OS support
+- [Dev Deps] update `@ljharb/eslint-config`, `evalmd`, `npmignore`, `tape`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
+
 ## **6.15.3**
 - [Fix] `parse`: enforce `throwOnLimitExceeded` for cumulative array growth via `combine`/`merge`
 - [Fix] `utils`: respect encoding of surrogate pairs across chunks (#559)
@@ -68,6 +112,13 @@
 - [New] `parse`: add `strictMerge` option to wrap object/primitive conflicts in an array (#425, #122)
 - [Fix] `duplicates` option should not apply to bracket notation keys (#514)
 
+## **6.14.3**
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [meta] use double quotes for better OS support
+- [Deps] update `side-channel`
+- [Dev Deps] update `@ljharb/eslint-config`, `es-value-fixtures`, `eslint`, `evalmd`, `mock-property`, `npmignore`, `tape`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
+
 ## **6.14.2**
 - [Fix] `parse`: mark overflow objects for indexed notation exceeding `arrayLimit` (#546)
 - [Fix] `arrayLimit` means max count, not max index, in `combine`/`merge`/`parseArrayValue`
@@ -100,6 +151,13 @@
 - [Dev Deps] update `es-value-fixtures`, `has-bigints`, `has-proto`, `has-symbols`
 - [Tests] increase coverage
 
+## **6.13.4**
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [meta] use double quotes for better OS support
+- [Deps] update `side-channel`
+- [Dev Deps] update `@ljharb/eslint-config`, `es-value-fixtures`, `eslint`, `evalmd`, `for-each`, `has-symbols`, `mock-property`, `npmignore`, `object-inspect`, `tape`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
+
 ## **6.13.3**
 [Fix] fix regressions from robustness refactor
 [actions] update reusable workflows
@@ -127,6 +185,13 @@
 - [New] `parse`: add `strictDepth` option (#511)
 - [Tests] use `npm audit` instead of `aud`
 
+## **6.12.6**
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [meta] use `npm audit` instead of `aud`
+- [Deps] update `side-channel`
+- [Dev Deps] update `@ljharb/eslint-config`, `es-value-fixtures`, `eslint`, `evalmd`, `for-each`, `has-symbols`, `mock-property`, `npmignore`, `object-inspect`, `tape`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
+
 ## **6.12.5**
 - [Fix] fix regressions from robustness refactor
 - [actions] update reusable workflows

package/node_modules/qs/README.md

@@ -85,7 +85,9 @@ assert.deepEqual(qs.parse('foo[bar][baz]=foobarbaz'), {
 });
 ```
 
-Since v6.14.1 and v6.15.2, `parse` interprets nested bracket groups more consistently. Query strings with unbalanced `[`/`]` can produce different results than in 6.15.1; see [#558](https://github.com/ljharb/qs/issues/558).
+Since v6.14.1 and v6.15.2, `parse` interprets nested bracket groups more consistently.
+Query strings with unbalanced `[`/`]` can produce different results than in 6.15.1;
+see [#558](https://github.com/ljharb/qs/issues/558).
 
 Because of that bracket grammar,
 **qs** does not agree with `URLSearchParams`,
@@ -132,6 +134,15 @@ var deep = qs.parse('a[b][c][d][e][f][g][h][i]=j', { depth: 1 });
 assert.deepEqual(deep, { a: { b: { '[c][d][e][f][g][h][i]': 'j' } } });
 ```
 
+Setting `depth` to `0` or `false` turns off nesting,
+so keys are never split into nested objects or arrays,
+whether or not their brackets are percent-encoded:
+
+```javascript
+assert.deepEqual(qs.parse('a[b][c]=d', { depth: 0 }), { 'a[b][c]': 'd' });
+assert.deepEqual(qs.parse('a%5Bb%5D=c', { depth: false }), { 'a[b]': 'c' });
+```
+
 You can configure **qs** to throw an error when parsing nested input beyond this depth using the `strictDepth` option (defaulted to false):
 
 ```javascript
@@ -143,16 +154,22 @@ try {
 }
 ```
 
-The depth limit helps mitigate abuse when **qs** is used to parse user input, and it is recommended to keep it a reasonably small number. The strictDepth option adds a layer of protection by throwing an error when the limit is exceeded, allowing you to catch and handle such cases.
+The depth limit helps mitigate abuse when **qs** is used to parse user input,
+and it is recommended to keep it a reasonably small number.
+The strictDepth option adds a layer of protection by throwing an error when the limit is exceeded,
+allowing you to catch and handle such cases.
 
-For similar reasons, by default **qs** will only parse up to 1000 parameters. This can be overridden by passing a `parameterLimit` option:
+For similar reasons, by default **qs** will only parse up to 1000 parameters.
+This can be overridden by passing a `parameterLimit` option:
 
 ```javascript
 var limited = qs.parse('a=b&c=d', { parameterLimit: 1 });
 assert.deepEqual(limited, { a: 'b' });
 ```
 
-If you want an error to be thrown whenever a limit is exceeded (eg, `parameterLimit`, `arrayLimit`), set the `throwOnLimitExceeded` option to `true`. This option will generate a descriptive error if the query string exceeds a configured limit.
+If you want an error to be thrown whenever a limit is exceeded (eg, `parameterLimit`, `arrayLimit`),
+set the `throwOnLimitExceeded` option to `true`.
+This option will generate a descriptive error if the query string exceeds a configured limit.
 ```javascript
 try {
     qs.parse('a=1&b=2&c=3&d=4', { parameterLimit: 3, throwOnLimitExceeded: true });
@@ -164,7 +181,10 @@ try {
 
 When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `parameterLimit` and ignore the rest without throwing an error.
 
-Note that `parameterLimit` only bounds the number of `&`-delimited parameters; it does not limit how many values a single parameter expands into. In particular, when `comma: true` is enabled, a single parameter's value is split on commas into arbitrarily many elements, which `parameterLimit` does not constrain. Setting `throwOnLimitExceeded: true` (see `arrayLimit` below) makes **qs** reject a query string with more than `parameterLimit` parameters, one that uses an array index of `arrayLimit` or greater, or one that would produce any array longer than `arrayLimit`, including an array produced by comma splitting. `arrayLimit` applies to each array separately, including each parameter's comma-split value, so the total number of values across all parameters can still reach `parameterLimit` times `arrayLimit`, which is 20,000 at the default limits; always bound the input size at the transport layer as well (e.g. an HTTP body-size limit).
+Note that `parameterLimit` only bounds the number of `&`-delimited parameters; it does not limit how many values a single parameter expands into.
+In particular, when `comma: true` is enabled, a single parameter's value is split on commas into arbitrarily many elements, which `parameterLimit` does not constrain.
+Setting `throwOnLimitExceeded: true` (see `arrayLimit` below) makes **qs** reject a query string with more than `parameterLimit` parameters, one that uses an array index of `arrayLimit` or greater, or one that would produce any array longer than `arrayLimit`, including an array produced by comma splitting.
+`arrayLimit` applies to each array separately, including each parameter's comma-split value, so the total number of values across all parameters can still reach `parameterLimit` times `arrayLimit`, which is 20,000 at the default limits; always bound the input size at the transport layer as well (e.g. an HTTP body-size limit).
 
 To bypass the leading question mark, use `ignoreQueryPrefix`:
 
@@ -324,7 +344,8 @@ var withArrayLimit = qs.parse('a[1]=b', { arrayLimit: 0 });
 assert.deepEqual(withArrayLimit, { a: { '1': 'b' } });
 ```
 
-If you want to throw an error whenever the array limit is exceeded, set the `throwOnLimitExceeded` option to `true`. This option will generate a descriptive error if the query string exceeds a configured limit.
+If you want to throw an error whenever the array limit is exceeded, set the `throwOnLimitExceeded` option to `true`.
+This option will generate a descriptive error if the query string exceeds a configured limit.
 ```javascript
 try {
     qs.parse('a[1]=b', { arrayLimit: 0, throwOnLimitExceeded: true });
@@ -336,7 +357,11 @@ try {
 
 When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `arrayLimit` and if the limit is exceeded, the array will instead be converted to an object with the index as the key.
 
-Note that `arrayLimit` is a *representation* threshold that controls when a numerically-indexed collection switches from an array to an object; it is **not** a hard cap on the total number of elements parsed. With the default `throwOnLimitExceeded: false`, exceeding `arrayLimit` never rejects or truncates input; it only changes the container type, and the resulting object still holds every element (so its size stays proportional to the input). This conversion is itself a safeguard: it avoids allocating a huge sparse array for input like `a[999999999]`. If you need a hard limit that rejects oversized arrays in untrusted query strings, set `throwOnLimitExceeded: true`. `throwOnLimitExceeded` still limits each array separately, not the total: with `comma: true`, each comma-separated group under `a[]=` counts as one element of the outer array, and can itself hold up to `arrayLimit` elements.
+Note that `arrayLimit` is a *representation* threshold that controls when a numerically-indexed collection switches from an array to an object; it is **not** a hard cap on the total number of elements parsed.
+With the default `throwOnLimitExceeded: false`, exceeding `arrayLimit` never rejects or truncates input; it only changes the container type, and the resulting object still holds every element (so its size stays proportional to the input).
+This conversion is itself a safeguard: it avoids allocating a huge sparse array for input like `a[999999999]`.
+If you need a hard limit that rejects oversized arrays in untrusted query strings, set `throwOnLimitExceeded: true`.
+`throwOnLimitExceeded` still limits each array separately, not the total: with `comma: true`, each comma-separated group under `a[]=` counts as one element of the outer array, and can itself hold up to `arrayLimit` elements.
 
 To prevent array syntax (`a[]`, `a[0]`) from being parsed as arrays, set `parseArrays` to `false`.
 Note that duplicate keys (e.g. `a=b&a=c`) may still produce arrays when `duplicates` is `'combine'` (the default).
@@ -408,7 +433,8 @@ If you wish to auto-convert values which look like numbers, booleans, and other
 qs.stringify(object, [options]);
 ```
 
-When stringifying, **qs** by default URI encodes output. Objects are stringified as you would expect:
+When stringifying, **qs** by default URI encodes output.
+Objects are stringified as you would expect:
 
 ```javascript
 assert.equal(qs.stringify({ a: 'b' }), 'a=b');
@@ -477,6 +503,20 @@ var encoded = qs.stringify({ a: { b: 'c' } }, { encoder: function (str, defaultE
 }})
 ```
 
+The encoder also receives the `format` option as a fifth argument.
+An encoder that wraps `defaultEncoder` should pass all of its arguments through,
+since the default encoding depends on `format` (for example, RFC1738 leaves parentheses unencoded):
+
+```javascript
+var wrapped = qs.stringify({ a: 'b(c)' }, {
+    format: 'RFC1738',
+    encoder: function (str, defaultEncoder, charset, type, format) {
+        return defaultEncoder(str, defaultEncoder, charset, type, format);
+    }
+});
+assert.equal(wrapped, 'a=b(c)');
+```
+
 The type argument is also provided to the decoder:
 
 ```javascript
@@ -690,7 +730,8 @@ var equalsInsensitive = qs.parse('a&b=');
 assert.deepEqual(equalsInsensitive, { a: '', b: '' });
 ```
 
-To distinguish between `null` values and empty strings use the `strictNullHandling` flag. In the result string the `null`
+To distinguish between `null` values and empty strings use the `strictNullHandling` flag.
+In the result string the `null`
 values have no `=` sign:
 
 ```javascript
@@ -758,7 +799,8 @@ var obj = qs.parse('a=%82%B1%82%F1%82%C9%82%BF%82%CD%81I', { decoder: decoder })
 assert.deepEqual(obj, { a: 'こんにちは！' });
 ```
 
-### RFC 3986 and RFC 1738 space encoding
+<a name="rfc-3986-and-rfc-1738-space-encoding"></a>
+### Encoding formats: RFC 3986, RFC 1738, and WHATWG
 
 RFC3986 used as default option and encodes ' ' to *%20* which is backward compatible.
 In the same time, output can be stringified as per RFC1738 with ' ' equal to '+'.
@@ -769,6 +811,17 @@ assert.equal(qs.stringify({ a: 'b c' }, { format : 'RFC3986' }), 'a=b%20c');
 assert.equal(qs.stringify({ a: 'b c' }, { format : 'RFC1738' }), 'a=b+c');
 ```
 
+To percent-encode keys and values the same way as the [WHATWG `application/x-www-form-urlencoded` serializer](https://url.spec.whatwg.org/#concept-urlencoded-serializer) (what `URLSearchParams` and HTML form submission use), use the `WHATWG` format.
+Like RFC1738 it encodes ' ' as '+'; it also leaves `*` unencoded, but percent-encodes `~`, `(`, and `)`.
+It only affects encoding; how `null`, dates, arrays, and objects are serialized is unchanged:
+
+```javascript
+assert.equal(qs.stringify({ a: 'b c~*()' }, { format: 'WHATWG' }), 'a=b+c%7E*%28%29');
+```
+
+_(Note: the `WHATWG` format matches `URLSearchParams` encoding only with the default `utf-8` charset, and only when keys are encoded too, so not with `encodeValuesOnly`.
+With `charset: 'iso-8859-1'`, every format uses the same `escape`-based encoding, which leaves characters like `@` and `/` unencoded; only the space handling differs)_
+
 ## Security
 
 Please email [@ljharb](https://github.com/ljharb) or see https://tidelift.com/security if you have a potential security vulnerability to report.