@socketsecurity/lib 1.3.3 → 1.3.4

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.3.4](https://github.com/SocketDev/socket-lib/releases/tag/v1.3.4) - 2025-10-26
+
+### Added
+
+- Added Node.js SIGUSR1 signal handler prevention utilities in `constants/node` module
+  - `supportsNodeDisableSigusr1Flag()`: Detects if Node supports `--disable-sigusr1` flag (v22.14+, v23.7+, v24.8+)
+  - `getNodeDisableSigusr1Flags()`: Returns appropriate flags to prevent debugger attachment
+    - Returns `['--disable-sigusr1']` on supported versions (prevents Signal I/O Thread creation)
+    - Falls back to `['--no-inspect']` on Node 18+ (blocks debugger but still creates thread)
+  - Enables production CLI environments to prevent SIGUSR1 debugger signal handling for security
+
 ## [1.3.3](https://github.com/SocketDev/socket-lib/releases/tag/v1.3.3) - 2025-10-24
 
 ### Fixed

package/dist/constants/node.d.ts

@@ -1,6 +1,3 @@
-/**
- * Node.js runtime: versions, features, flags, and capabilities.
- */
 // Version detection.
 export declare function getNodeVersion(): string;
 export declare function getNodeMajorVersion(): number;
@@ -17,6 +14,8 @@ export declare function supportsNodeDisableWarningFlag(): boolean;
 export declare function supportsNodePermissionFlag(): boolean;
 export declare function supportsNodeRequireModule(): boolean;
 export declare function supportsNodeRun(): boolean;
+export declare function supportsNodeDisableSigusr1Flag(): boolean;
+export declare function getNodeDisableSigusr1Flags(): string[];
 export declare function supportsProcessSend(): boolean;
 export declare function getNodeDebugFlags(): string[];
 export declare function getNodeHardenFlags(): string[];

package/dist/constants/node.js

@@ -1,3 +1,3 @@
 /* Socket Lib - Built with esbuild */
-var a=Object.defineProperty;var d=Object.getOwnPropertyDescriptor;var g=Object.getOwnPropertyNames;var f=Object.prototype.hasOwnProperty;var m=(e,n)=>{for(var t in n)a(e,t,{get:n[t],enumerable:!0})},x=(e,n,t,l)=>{if(n&&typeof n=="object"||typeof n=="function")for(let r of g(n))!f.call(e,r)&&r!==t&&a(e,r,{get:()=>n[r],enumerable:!(l=d(n,r))||l.enumerable});return e};var b=e=>x(a({},"__esModule",{value:!0}),e);var I={};m(I,{ESNEXT:()=>A,NODE_SEA_FUSE:()=>O,getExecPath:()=>C,getMaintainedNodeVersions:()=>j,getNodeDebugFlags:()=>S,getNodeHardenFlags:()=>V,getNodeMajorVersion:()=>o,getNodeNoWarningsFlags:()=>D,getNodePermissionFlags:()=>w,getNodeVersion:()=>N,supportsNodeCompileCacheApi:()=>F,supportsNodeCompileCacheEnvVar:()=>_,supportsNodeDisableWarningFlag:()=>E,supportsNodePermissionFlag:()=>h,supportsNodeRequireModule:()=>v,supportsNodeRun:()=>y,supportsProcessSend:()=>P});module.exports=b(I);function N(){return process.version}function o(){return Number.parseInt(process.version.slice(1).split(".")[0]||"0",10)}let s;function j(){if(s===void 0)try{s=require("../lib/maintained-node-versions")}catch{s=Object.freeze(Object.assign([],{current:"",last:"",next:"",previous:""}))}return s}function F(){return o()>=24}function _(){return o()>=22}function E(){return o()>=21}function h(){return o()>=20}function v(){const e=o();return e>=23||e===22&&Number.parseInt(process.version.split(".")[1]||"0",10)>=12}function y(){const e=o();return e>=23||e===22&&Number.parseInt(process.version.split(".")[1]||"0",10)>=11}function P(){return typeof process.send=="function"}let p;function S(){return p===void 0&&(p=["--inspect","--inspect-brk","--inspect-port","--inspect-publish-uid"]),p}let u;function V(){if(u===void 0){const e=o(),n=["--disable-proto=delete",e>=24?"--permission":"--experimental-permission","--force-node-api-uncaught-exceptions-policy"];e<24&&n.push("--experimental-policy"),u=n}return u}let i;function w(){return i===void 0&&(o()>=24?i=["--allow-fs-read=*","--allow-fs-write=*","--allow-child-process"]:i=[]),i}let c;function D(){return c===void 0&&(c=["--no-warnings","--no-deprecation"]),c}function C(){return process.execPath}const O="NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2",A="esnext";0&&(module.exports={ESNEXT,NODE_SEA_FUSE,getExecPath,getMaintainedNodeVersions,getNodeDebugFlags,getNodeHardenFlags,getNodeMajorVersion,getNodeNoWarningsFlags,getNodePermissionFlags,getNodeVersion,supportsNodeCompileCacheApi,supportsNodeCompileCacheEnvVar,supportsNodeDisableWarningFlag,supportsNodePermissionFlag,supportsNodeRequireModule,supportsNodeRun,supportsProcessSend});
+var u=Object.defineProperty;var m=Object.getOwnPropertyDescriptor;var b=Object.getOwnPropertyNames;var N=Object.prototype.hasOwnProperty;var x=(e,n)=>{for(var s in n)u(e,s,{get:n[s],enumerable:!0})},j=(e,n,s,g)=>{if(n&&typeof n=="object"||typeof n=="function")for(let t of b(n))!N.call(e,t)&&t!==s&&u(e,t,{get:()=>n[t],enumerable:!(g=m(n,t))||g.enumerable});return e};var F=e=>j(u({},"__esModule",{value:!0}),e);var q={};x(q,{ESNEXT:()=>W,NODE_SEA_FUSE:()=>R,getExecPath:()=>M,getMaintainedNodeVersions:()=>E,getNodeDebugFlags:()=>w,getNodeDisableSigusr1Flags:()=>O,getNodeHardenFlags:()=>v,getNodeMajorVersion:()=>r,getNodeNoWarningsFlags:()=>A,getNodePermissionFlags:()=>C,getNodeVersion:()=>_,supportsNodeCompileCacheApi:()=>S,supportsNodeCompileCacheEnvVar:()=>h,supportsNodeDisableSigusr1Flag:()=>f,supportsNodeDisableWarningFlag:()=>D,supportsNodePermissionFlag:()=>I,supportsNodeRequireModule:()=>V,supportsNodeRun:()=>y,supportsProcessSend:()=>P});module.exports=F(q);const o=process.version;function _(){return o}function r(){return Number.parseInt(o.slice(1).split(".")[0]||"0",10)}let i;function E(){if(i===void 0)try{i=require("../lib/maintained-node-versions")}catch{i=Object.freeze(Object.assign([],{current:"",last:"",next:"",previous:""}))}return i}function S(){return r()>=24}function h(){return r()>=22}function D(){return r()>=21}function I(){return r()>=20}function V(){const e=r();return e>=23||e===22&&Number.parseInt(o.split(".")[1]||"0",10)>=12}function y(){const e=r();return e>=23||e===22&&Number.parseInt(o.split(".")[1]||"0",10)>=11}function f(){const e=r();return e>=24?Number.parseInt(o.split(".")[1]||"0",10)>=8:e===23?Number.parseInt(o.split(".")[1]||"0",10)>=7:e===22?Number.parseInt(o.split(".")[1]||"0",10)>=14:!1}let p;function O(){return p===void 0&&(p=f()?["--disable-sigusr1"]:["--no-inspect"]),p}function P(){return typeof process.send=="function"}let c;function w(){return c===void 0&&(c=["--inspect","--inspect-brk","--inspect-port","--inspect-publish-uid"]),c}let l;function v(){if(l===void 0){const e=r(),n=["--disable-proto=delete",e>=24?"--permission":"--experimental-permission","--force-node-api-uncaught-exceptions-policy"];e<24&&n.push("--experimental-policy"),l=n}return l}let a;function C(){return a===void 0&&(r()>=24?a=["--allow-fs-read=*","--allow-fs-write=*","--allow-child-process"]:a=[]),a}let d;function A(){return d===void 0&&(d=["--no-warnings","--no-deprecation"]),d}function M(){return process.execPath}const R="NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2",W="esnext";0&&(module.exports={ESNEXT,NODE_SEA_FUSE,getExecPath,getMaintainedNodeVersions,getNodeDebugFlags,getNodeDisableSigusr1Flags,getNodeHardenFlags,getNodeMajorVersion,getNodeNoWarningsFlags,getNodePermissionFlags,getNodeVersion,supportsNodeCompileCacheApi,supportsNodeCompileCacheEnvVar,supportsNodeDisableSigusr1Flag,supportsNodeDisableWarningFlag,supportsNodePermissionFlag,supportsNodeRequireModule,supportsNodeRun,supportsProcessSend});
 //# sourceMappingURL=node.js.map

package/dist/constants/node.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/constants/node.ts"],
-  "sourcesContent": ["/**\n * Node.js runtime: versions, features, flags, and capabilities.\n */\n\n// Version detection.\nexport function getNodeVersion(): string {\n  return process.version\n}\n\nexport function getNodeMajorVersion(): number {\n  return Number.parseInt(process.version.slice(1).split('.')[0] || '0', 10)\n}\n\n// Maintained Node.js versions.\nlet _maintainedNodeVersions:\n  | (readonly string[] & {\n      current: string\n      last: string\n      next: string\n      previous: string\n    })\n  | undefined\nexport function getMaintainedNodeVersions() {\n  if (_maintainedNodeVersions === undefined) {\n    try {\n      _maintainedNodeVersions = require('../lib/maintained-node-versions')\n    } catch {\n      _maintainedNodeVersions = Object.freeze(\n        Object.assign([], {\n          current: '',\n          last: '',\n          next: '',\n          previous: '',\n        }),\n      ) as typeof _maintainedNodeVersions\n    }\n  }\n  return _maintainedNodeVersions\n}\n\n// Feature detection.\nexport function supportsNodeCompileCacheApi(): boolean {\n  const major = getNodeMajorVersion()\n  return major >= 24\n}\n\nexport function supportsNodeCompileCacheEnvVar(): boolean {\n  const major = getNodeMajorVersion()\n  return major >= 22\n}\n\nexport function supportsNodeDisableWarningFlag(): boolean {\n  const major = getNodeMajorVersion()\n  return major >= 21\n}\n\nexport function supportsNodePermissionFlag(): boolean {\n  const major = getNodeMajorVersion()\n  return major >= 20\n}\n\nexport function supportsNodeRequireModule(): boolean {\n  const major = getNodeMajorVersion()\n  return (\n    major >= 23 ||\n    (major === 22 &&\n      Number.parseInt(process.version.split('.')[1] || '0', 10) >= 12)\n  )\n}\n\nexport function supportsNodeRun(): boolean {\n  const major = getNodeMajorVersion()\n  return (\n    major >= 23 ||\n    (major === 22 &&\n      Number.parseInt(process.version.split('.')[1] || '0', 10) >= 11)\n  )\n}\n\nexport function supportsProcessSend(): boolean {\n  return typeof process.send === 'function'\n}\n\n// Node.js flags.\nlet _nodeDebugFlags: string[]\nexport function getNodeDebugFlags(): string[] {\n  if (_nodeDebugFlags === undefined) {\n    _nodeDebugFlags = [\n      '--inspect',\n      '--inspect-brk',\n      '--inspect-port',\n      '--inspect-publish-uid',\n    ]\n  }\n  return _nodeDebugFlags\n}\n\nlet _nodeHardenFlags: string[]\nexport function getNodeHardenFlags(): string[] {\n  if (_nodeHardenFlags === undefined) {\n    const major = getNodeMajorVersion()\n    const flags = [\n      '--disable-proto=delete',\n      // Node.js 24+ uses --permission instead of --experimental-permission.\n      // The permission model graduated from experimental to production-ready.\n      major >= 24 ? '--permission' : '--experimental-permission',\n      // Force uncaught exceptions policy for N-API addons (Node.js 22+).\n      '--force-node-api-uncaught-exceptions-policy',\n    ]\n    // Only add policy flag if we're using experimental permission (Node < 24).\n    // Node 24+ --policy requires a policy file which we don't have.\n    if (major < 24) {\n      flags.push('--experimental-policy')\n    }\n    _nodeHardenFlags = flags\n  }\n  return _nodeHardenFlags\n}\n\nlet _nodePermissionFlags: string[]\nexport function getNodePermissionFlags(): string[] {\n  if (_nodePermissionFlags === undefined) {\n    const major = getNodeMajorVersion()\n    // Node.js 24+ requires explicit permission grants when using --permission flag.\n    // npm needs filesystem access to read package.json files and node_modules.\n    if (major >= 24) {\n      _nodePermissionFlags = [\n        // Allow reading from the entire filesystem (npm needs to read package.json, node_modules, etc.).\n        '--allow-fs-read=*',\n        // Allow writing to the entire filesystem (npm needs to write to node_modules, cache, etc.).\n        '--allow-fs-write=*',\n        // Allow spawning child processes (npm needs to run lifecycle scripts, git, etc.).\n        '--allow-child-process',\n      ]\n    } else {\n      // Node.js 20-23 with --experimental-permission doesn't require explicit grants\n      // or uses different permission API.\n      _nodePermissionFlags = []\n    }\n  }\n  return _nodePermissionFlags\n}\n\nlet _nodeNoWarningsFlags: string[]\nexport function getNodeNoWarningsFlags(): string[] {\n  if (_nodeNoWarningsFlags === undefined) {\n    _nodeNoWarningsFlags = ['--no-warnings', '--no-deprecation']\n  }\n  return _nodeNoWarningsFlags\n}\n\n// Execution path.\nexport function getExecPath(): string {\n  return process.execPath\n}\n\n// Node.js constants.\nexport const NODE_SEA_FUSE = 'NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2'\nexport const ESNEXT = 'esnext'\n"],
-  "mappings": ";4ZAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,YAAAE,EAAA,kBAAAC,EAAA,gBAAAC,EAAA,8BAAAC,EAAA,sBAAAC,EAAA,uBAAAC,EAAA,wBAAAC,EAAA,2BAAAC,EAAA,2BAAAC,EAAA,mBAAAC,EAAA,gCAAAC,EAAA,mCAAAC,EAAA,mCAAAC,EAAA,+BAAAC,EAAA,8BAAAC,EAAA,oBAAAC,EAAA,wBAAAC,IAAA,eAAAC,EAAAnB,GAKO,SAASW,GAAyB,CACvC,OAAO,QAAQ,OACjB,CAEO,SAASH,GAA8B,CAC5C,OAAO,OAAO,SAAS,QAAQ,QAAQ,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,CAAC,GAAK,IAAK,EAAE,CAC1E,CAGA,IAAIY,EAQG,SAASf,GAA4B,CAC1C,GAAIe,IAA4B,OAC9B,GAAI,CACFA,EAA0B,QAAQ,iCAAiC,CACrE,MAAQ,CACNA,EAA0B,OAAO,OAC/B,OAAO,OAAO,CAAC,EAAG,CAChB,QAAS,GACT,KAAM,GACN,KAAM,GACN,SAAU,EACZ,CAAC,CACH,CACF,CAEF,OAAOA,CACT,CAGO,SAASR,GAAuC,CAErD,OADcJ,EAAoB,GAClB,EAClB,CAEO,SAASK,GAA0C,CAExD,OADcL,EAAoB,GAClB,EAClB,CAEO,SAASM,GAA0C,CAExD,OADcN,EAAoB,GAClB,EAClB,CAEO,SAASO,GAAsC,CAEpD,OADcP,EAAoB,GAClB,EAClB,CAEO,SAASQ,GAAqC,CACnD,MAAMK,EAAQb,EAAoB,EAClC,OACEa,GAAS,IACRA,IAAU,IACT,OAAO,SAAS,QAAQ,QAAQ,MAAM,GAAG,EAAE,CAAC,GAAK,IAAK,EAAE,GAAK,EAEnE,CAEO,SAASJ,GAA2B,CACzC,MAAMI,EAAQb,EAAoB,EAClC,OACEa,GAAS,IACRA,IAAU,IACT,OAAO,SAAS,QAAQ,QAAQ,MAAM,GAAG,EAAE,CAAC,GAAK,IAAK,EAAE,GAAK,EAEnE,CAEO,SAASH,GAA+B,CAC7C,OAAO,OAAO,QAAQ,MAAS,UACjC,CAGA,IAAII,EACG,SAAShB,GAA8B,CAC5C,OAAIgB,IAAoB,SACtBA,EAAkB,CAChB,YACA,gBACA,iBACA,uBACF,GAEKA,CACT,CAEA,IAAIC,EACG,SAAShB,GAA+B,CAC7C,GAAIgB,IAAqB,OAAW,CAClC,MAAMF,EAAQb,EAAoB,EAC5BgB,EAAQ,CACZ,yBAGAH,GAAS,GAAK,eAAiB,4BAE/B,6CACF,EAGIA,EAAQ,IACVG,EAAM,KAAK,uBAAuB,EAEpCD,EAAmBC,CACrB,CACA,OAAOD,CACT,CAEA,IAAIE,EACG,SAASf,GAAmC,CACjD,OAAIe,IAAyB,SACbjB,EAAoB,GAGrB,GACXiB,EAAuB,CAErB,oBAEA,qBAEA,uBACF,EAIAA,EAAuB,CAAC,GAGrBA,CACT,CAEA,IAAIC,EACG,SAASjB,GAAmC,CACjD,OAAIiB,IAAyB,SAC3BA,EAAuB,CAAC,gBAAiB,kBAAkB,GAEtDA,CACT,CAGO,SAAStB,GAAsB,CACpC,OAAO,QAAQ,QACjB,CAGO,MAAMD,EAAgB,iDAChBD,EAAS",
-  "names": ["node_exports", "__export", "ESNEXT", "NODE_SEA_FUSE", "getExecPath", "getMaintainedNodeVersions", "getNodeDebugFlags", "getNodeHardenFlags", "getNodeMajorVersion", "getNodeNoWarningsFlags", "getNodePermissionFlags", "getNodeVersion", "supportsNodeCompileCacheApi", "supportsNodeCompileCacheEnvVar", "supportsNodeDisableWarningFlag", "supportsNodePermissionFlag", "supportsNodeRequireModule", "supportsNodeRun", "supportsProcessSend", "__toCommonJS", "_maintainedNodeVersions", "major", "_nodeDebugFlags", "_nodeHardenFlags", "flags", "_nodePermissionFlags", "_nodeNoWarningsFlags"]
+  "sourcesContent": ["/**\n * Node.js runtime: versions, features, flags, and capabilities.\n */\n\nconst NODE_VERSION = process.version\n\n// Version detection.\nexport function getNodeVersion(): string {\n  return NODE_VERSION\n}\n\nexport function getNodeMajorVersion(): number {\n  return Number.parseInt(NODE_VERSION.slice(1).split('.')[0] || '0', 10)\n}\n\n// Maintained Node.js versions.\nlet _maintainedNodeVersions:\n  | (readonly string[] & {\n      current: string\n      last: string\n      next: string\n      previous: string\n    })\n  | undefined\nexport function getMaintainedNodeVersions() {\n  if (_maintainedNodeVersions === undefined) {\n    try {\n      _maintainedNodeVersions = require('../lib/maintained-node-versions')\n    } catch {\n      _maintainedNodeVersions = Object.freeze(\n        Object.assign([], {\n          current: '',\n          last: '',\n          next: '',\n          previous: '',\n        }),\n      ) as typeof _maintainedNodeVersions\n    }\n  }\n  return _maintainedNodeVersions\n}\n\n// Feature detection.\nexport function supportsNodeCompileCacheApi(): boolean {\n  const major = getNodeMajorVersion()\n  return major >= 24\n}\n\nexport function supportsNodeCompileCacheEnvVar(): boolean {\n  const major = getNodeMajorVersion()\n  return major >= 22\n}\n\nexport function supportsNodeDisableWarningFlag(): boolean {\n  const major = getNodeMajorVersion()\n  return major >= 21\n}\n\nexport function supportsNodePermissionFlag(): boolean {\n  const major = getNodeMajorVersion()\n  return major >= 20\n}\n\nexport function supportsNodeRequireModule(): boolean {\n  const major = getNodeMajorVersion()\n  return (\n    major >= 23 ||\n    (major === 22 &&\n      Number.parseInt(NODE_VERSION.split('.')[1] || '0', 10) >= 12)\n  )\n}\n\nexport function supportsNodeRun(): boolean {\n  const major = getNodeMajorVersion()\n  return (\n    major >= 23 ||\n    (major === 22 &&\n      Number.parseInt(NODE_VERSION.split('.')[1] || '0', 10) >= 11)\n  )\n}\n\nexport function supportsNodeDisableSigusr1Flag(): boolean {\n  const major = getNodeMajorVersion()\n  // --disable-sigusr1 added in v22.14.0, v23.7.0.\n  // Stabilized in v22.20.0, v24.8.0.\n  if (major >= 24) {\n    const minor = Number.parseInt(NODE_VERSION.split('.')[1] || '0', 10)\n    return minor >= 8\n  }\n  if (major === 23) {\n    const minor = Number.parseInt(NODE_VERSION.split('.')[1] || '0', 10)\n    return minor >= 7\n  }\n  if (major === 22) {\n    const minor = Number.parseInt(NODE_VERSION.split('.')[1] || '0', 10)\n    return minor >= 14\n  }\n  return false\n}\n\nlet _nodeDisableSigusr1Flags: string[]\nexport function getNodeDisableSigusr1Flags(): string[] {\n  if (_nodeDisableSigusr1Flags === undefined) {\n    // SIGUSR1 is reserved by Node.js for starting the debugger/inspector.\n    // In production CLI environments, we want to prevent debugger attachment.\n    //\n    // --disable-sigusr1: Prevents Signal I/O Thread from listening to SIGUSR1 (v22.14.0+).\n    // --no-inspect: Disables inspector on older Node versions that don't support --disable-sigusr1.\n    //\n    // Note: --disable-sigusr1 is the correct solution (prevents thread creation entirely).\n    // --no-inspect is a fallback that still creates the signal handler thread but blocks later.\n    _nodeDisableSigusr1Flags = supportsNodeDisableSigusr1Flag()\n      ? ['--disable-sigusr1']\n      : ['--no-inspect']\n  }\n  return _nodeDisableSigusr1Flags\n}\n\nexport function supportsProcessSend(): boolean {\n  return typeof process.send === 'function'\n}\n\n// Node.js flags.\nlet _nodeDebugFlags: string[]\nexport function getNodeDebugFlags(): string[] {\n  if (_nodeDebugFlags === undefined) {\n    _nodeDebugFlags = [\n      '--inspect',\n      '--inspect-brk',\n      '--inspect-port',\n      '--inspect-publish-uid',\n    ]\n  }\n  return _nodeDebugFlags\n}\n\nlet _nodeHardenFlags: string[]\nexport function getNodeHardenFlags(): string[] {\n  if (_nodeHardenFlags === undefined) {\n    const major = getNodeMajorVersion()\n    const flags = [\n      '--disable-proto=delete',\n      // Node.js 24+ uses --permission instead of --experimental-permission.\n      // The permission model graduated from experimental to production-ready.\n      major >= 24 ? '--permission' : '--experimental-permission',\n      // Force uncaught exceptions policy for N-API addons (Node.js 22+).\n      '--force-node-api-uncaught-exceptions-policy',\n    ]\n    // Only add policy flag if we're using experimental permission (Node < 24).\n    // Node 24+ --policy requires a policy file which we don't have.\n    if (major < 24) {\n      flags.push('--experimental-policy')\n    }\n    _nodeHardenFlags = flags\n  }\n  return _nodeHardenFlags\n}\n\nlet _nodePermissionFlags: string[]\nexport function getNodePermissionFlags(): string[] {\n  if (_nodePermissionFlags === undefined) {\n    const major = getNodeMajorVersion()\n    // Node.js 24+ requires explicit permission grants when using --permission flag.\n    // npm needs filesystem access to read package.json files and node_modules.\n    if (major >= 24) {\n      _nodePermissionFlags = [\n        // Allow reading from the entire filesystem (npm needs to read package.json, node_modules, etc.).\n        '--allow-fs-read=*',\n        // Allow writing to the entire filesystem (npm needs to write to node_modules, cache, etc.).\n        '--allow-fs-write=*',\n        // Allow spawning child processes (npm needs to run lifecycle scripts, git, etc.).\n        '--allow-child-process',\n      ]\n    } else {\n      // Node.js 20-23 with --experimental-permission doesn't require explicit grants\n      // or uses different permission API.\n      _nodePermissionFlags = []\n    }\n  }\n  return _nodePermissionFlags\n}\n\nlet _nodeNoWarningsFlags: string[]\nexport function getNodeNoWarningsFlags(): string[] {\n  if (_nodeNoWarningsFlags === undefined) {\n    _nodeNoWarningsFlags = ['--no-warnings', '--no-deprecation']\n  }\n  return _nodeNoWarningsFlags\n}\n\n// Execution path.\nexport function getExecPath(): string {\n  return process.execPath\n}\n\n// Node.js constants.\nexport const NODE_SEA_FUSE = 'NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2'\nexport const ESNEXT = 'esnext'\n"],
+  "mappings": ";4ZAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,YAAAE,EAAA,kBAAAC,EAAA,gBAAAC,EAAA,8BAAAC,EAAA,sBAAAC,EAAA,+BAAAC,EAAA,uBAAAC,EAAA,wBAAAC,EAAA,2BAAAC,EAAA,2BAAAC,EAAA,mBAAAC,EAAA,gCAAAC,EAAA,mCAAAC,EAAA,mCAAAC,EAAA,mCAAAC,EAAA,+BAAAC,EAAA,8BAAAC,EAAA,oBAAAC,EAAA,wBAAAC,IAAA,eAAAC,EAAArB,GAIA,MAAMsB,EAAe,QAAQ,QAGtB,SAASV,GAAyB,CACvC,OAAOU,CACT,CAEO,SAASb,GAA8B,CAC5C,OAAO,OAAO,SAASa,EAAa,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,CAAC,GAAK,IAAK,EAAE,CACvE,CAGA,IAAIC,EAQG,SAASlB,GAA4B,CAC1C,GAAIkB,IAA4B,OAC9B,GAAI,CACFA,EAA0B,QAAQ,iCAAiC,CACrE,MAAQ,CACNA,EAA0B,OAAO,OAC/B,OAAO,OAAO,CAAC,EAAG,CAChB,QAAS,GACT,KAAM,GACN,KAAM,GACN,SAAU,EACZ,CAAC,CACH,CACF,CAEF,OAAOA,CACT,CAGO,SAASV,GAAuC,CAErD,OADcJ,EAAoB,GAClB,EAClB,CAEO,SAASK,GAA0C,CAExD,OADcL,EAAoB,GAClB,EAClB,CAEO,SAASO,GAA0C,CAExD,OADcP,EAAoB,GAClB,EAClB,CAEO,SAASQ,GAAsC,CAEpD,OADcR,EAAoB,GAClB,EAClB,CAEO,SAASS,GAAqC,CACnD,MAAMM,EAAQf,EAAoB,EAClC,OACEe,GAAS,IACRA,IAAU,IACT,OAAO,SAASF,EAAa,MAAM,GAAG,EAAE,CAAC,GAAK,IAAK,EAAE,GAAK,EAEhE,CAEO,SAASH,GAA2B,CACzC,MAAMK,EAAQf,EAAoB,EAClC,OACEe,GAAS,IACRA,IAAU,IACT,OAAO,SAASF,EAAa,MAAM,GAAG,EAAE,CAAC,GAAK,IAAK,EAAE,GAAK,EAEhE,CAEO,SAASP,GAA0C,CACxD,MAAMS,EAAQf,EAAoB,EAGlC,OAAIe,GAAS,GACG,OAAO,SAASF,EAAa,MAAM,GAAG,EAAE,CAAC,GAAK,IAAK,EAAE,GACnD,EAEdE,IAAU,GACE,OAAO,SAASF,EAAa,MAAM,GAAG,EAAE,CAAC,GAAK,IAAK,EAAE,GACnD,EAEdE,IAAU,GACE,OAAO,SAASF,EAAa,MAAM,GAAG,EAAE,CAAC,GAAK,IAAK,EAAE,GACnD,GAEX,EACT,CAEA,IAAIG,EACG,SAASlB,GAAuC,CACrD,OAAIkB,IAA6B,SAS/BA,EAA2BV,EAA+B,EACtD,CAAC,mBAAmB,EACpB,CAAC,cAAc,GAEdU,CACT,CAEO,SAASL,GAA+B,CAC7C,OAAO,OAAO,QAAQ,MAAS,UACjC,CAGA,IAAIM,EACG,SAASpB,GAA8B,CAC5C,OAAIoB,IAAoB,SACtBA,EAAkB,CAChB,YACA,gBACA,iBACA,uBACF,GAEKA,CACT,CAEA,IAAIC,EACG,SAASnB,GAA+B,CAC7C,GAAImB,IAAqB,OAAW,CAClC,MAAMH,EAAQf,EAAoB,EAC5BmB,EAAQ,CACZ,yBAGAJ,GAAS,GAAK,eAAiB,4BAE/B,6CACF,EAGIA,EAAQ,IACVI,EAAM,KAAK,uBAAuB,EAEpCD,EAAmBC,CACrB,CACA,OAAOD,CACT,CAEA,IAAIE,EACG,SAASlB,GAAmC,CACjD,OAAIkB,IAAyB,SACbpB,EAAoB,GAGrB,GACXoB,EAAuB,CAErB,oBAEA,qBAEA,uBACF,EAIAA,EAAuB,CAAC,GAGrBA,CACT,CAEA,IAAIC,EACG,SAASpB,GAAmC,CACjD,OAAIoB,IAAyB,SAC3BA,EAAuB,CAAC,gBAAiB,kBAAkB,GAEtDA,CACT,CAGO,SAAS1B,GAAsB,CACpC,OAAO,QAAQ,QACjB,CAGO,MAAMD,EAAgB,iDAChBD,EAAS",
+  "names": ["node_exports", "__export", "ESNEXT", "NODE_SEA_FUSE", "getExecPath", "getMaintainedNodeVersions", "getNodeDebugFlags", "getNodeDisableSigusr1Flags", "getNodeHardenFlags", "getNodeMajorVersion", "getNodeNoWarningsFlags", "getNodePermissionFlags", "getNodeVersion", "supportsNodeCompileCacheApi", "supportsNodeCompileCacheEnvVar", "supportsNodeDisableSigusr1Flag", "supportsNodeDisableWarningFlag", "supportsNodePermissionFlag", "supportsNodeRequireModule", "supportsNodeRun", "supportsProcessSend", "__toCommonJS", "NODE_VERSION", "_maintainedNodeVersions", "major", "_nodeDisableSigusr1Flags", "_nodeDebugFlags", "_nodeHardenFlags", "flags", "_nodePermissionFlags", "_nodeNoWarningsFlags"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/lib",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "license": "MIT",
   "description": "Core utilities and infrastructure for Socket.dev security tools",
   "keywords": [
@@ -760,8 +760,8 @@
     "@socketregistry/yocto-spinner": "1.0.19",
     "@types/node": "24.6.2",
     "@typescript/native-preview": "7.0.0-dev.20250920.1",
-    "@vitest/coverage-v8": "3.2.4",
-    "@vitest/ui": "3.2.4",
+    "@vitest/coverage-v8": "4.0.3",
+    "@vitest/ui": "4.0.3",
     "@yarnpkg/extensions": "2.0.6",
     "cacache": "20.0.1",
     "debug": "4.4.3",
@@ -799,7 +799,7 @@
     "typescript-eslint": "8.44.1",
     "validate-npm-package-name": "6.0.2",
     "vite-tsconfig-paths": "5.1.4",
-    "vitest": "3.2.4",
+    "vitest": "4.0.3",
     "which": "5.0.0",
     "yargs-parser": "22.0.0",
     "yoctocolors-cjs": "2.1.3",