@socketsecurity/lib 5.11.2 → 5.11.3

package/dist/external/p-map.js

@@ -0,0 +1,240 @@
+"use strict";
+/**
+ * Bundled from p-map
+ * This is a zero-dependency bundle created by esbuild.
+ */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// node_modules/.pnpm/p-map@7.0.4/node_modules/p-map/index.js
+var p_map_exports = {};
+__export(p_map_exports, {
+  default: () => pMap,
+  pMapIterable: () => pMapIterable,
+  pMapSkip: () => pMapSkip
+});
+async function pMap(iterable, mapper, {
+  concurrency = Number.POSITIVE_INFINITY,
+  stopOnError = true,
+  signal
+} = {}) {
+  return new Promise((resolve_, reject_) => {
+    if (iterable[Symbol.iterator] === void 0 && iterable[Symbol.asyncIterator] === void 0) {
+      throw new TypeError(`Expected \`input\` to be either an \`Iterable\` or \`AsyncIterable\`, got (${typeof iterable})`);
+    }
+    if (typeof mapper !== "function") {
+      throw new TypeError("Mapper function is required");
+    }
+    if (!(Number.isSafeInteger(concurrency) && concurrency >= 1 || concurrency === Number.POSITIVE_INFINITY)) {
+      throw new TypeError(`Expected \`concurrency\` to be an integer from 1 and up or \`Infinity\`, got \`${concurrency}\` (${typeof concurrency})`);
+    }
+    const result = [];
+    const errors = [];
+    const skippedIndexesMap = /* @__PURE__ */ new Map();
+    let isRejected = false;
+    let isResolved = false;
+    let isIterableDone = false;
+    let resolvingCount = 0;
+    let currentIndex = 0;
+    const iterator = iterable[Symbol.iterator] === void 0 ? iterable[Symbol.asyncIterator]() : iterable[Symbol.iterator]();
+    const signalListener = /* @__PURE__ */ __name(() => {
+      reject(signal.reason);
+    }, "signalListener");
+    const cleanup = /* @__PURE__ */ __name(() => {
+      signal?.removeEventListener("abort", signalListener);
+    }, "cleanup");
+    const resolve = /* @__PURE__ */ __name((value) => {
+      resolve_(value);
+      cleanup();
+    }, "resolve");
+    const reject = /* @__PURE__ */ __name((reason) => {
+      isRejected = true;
+      isResolved = true;
+      reject_(reason);
+      cleanup();
+    }, "reject");
+    if (signal) {
+      if (signal.aborted) {
+        reject(signal.reason);
+      }
+      signal.addEventListener("abort", signalListener, { once: true });
+    }
+    const next = /* @__PURE__ */ __name(async () => {
+      if (isResolved) {
+        return;
+      }
+      const nextItem = await iterator.next();
+      const index = currentIndex;
+      currentIndex++;
+      if (nextItem.done) {
+        isIterableDone = true;
+        if (resolvingCount === 0 && !isResolved) {
+          if (!stopOnError && errors.length > 0) {
+            reject(new AggregateError(errors));
+            return;
+          }
+          isResolved = true;
+          if (skippedIndexesMap.size === 0) {
+            resolve(result);
+            return;
+          }
+          const pureResult = [];
+          for (const [index2, value] of result.entries()) {
+            if (skippedIndexesMap.get(index2) === pMapSkip) {
+              continue;
+            }
+            pureResult.push(value);
+          }
+          resolve(pureResult);
+        }
+        return;
+      }
+      resolvingCount++;
+      (async () => {
+        try {
+          const element = await nextItem.value;
+          if (isResolved) {
+            return;
+          }
+          const value = await mapper(element, index);
+          if (value === pMapSkip) {
+            skippedIndexesMap.set(index, value);
+          }
+          result[index] = value;
+          resolvingCount--;
+          await next();
+        } catch (error) {
+          if (stopOnError) {
+            reject(error);
+          } else {
+            errors.push(error);
+            resolvingCount--;
+            try {
+              await next();
+            } catch (error2) {
+              reject(error2);
+            }
+          }
+        }
+      })();
+    }, "next");
+    (async () => {
+      for (let index = 0; index < concurrency; index++) {
+        try {
+          await next();
+        } catch (error) {
+          reject(error);
+          break;
+        }
+        if (isIterableDone || isRejected) {
+          break;
+        }
+      }
+    })();
+  });
+}
+function pMapIterable(iterable, mapper, {
+  concurrency = Number.POSITIVE_INFINITY,
+  backpressure = concurrency
+} = {}) {
+  if (iterable[Symbol.iterator] === void 0 && iterable[Symbol.asyncIterator] === void 0) {
+    throw new TypeError(`Expected \`input\` to be either an \`Iterable\` or \`AsyncIterable\`, got (${typeof iterable})`);
+  }
+  if (typeof mapper !== "function") {
+    throw new TypeError("Mapper function is required");
+  }
+  if (!(Number.isSafeInteger(concurrency) && concurrency >= 1 || concurrency === Number.POSITIVE_INFINITY)) {
+    throw new TypeError(`Expected \`concurrency\` to be an integer from 1 and up or \`Infinity\`, got \`${concurrency}\` (${typeof concurrency})`);
+  }
+  if (!(Number.isSafeInteger(backpressure) && backpressure >= concurrency || backpressure === Number.POSITIVE_INFINITY)) {
+    throw new TypeError(`Expected \`backpressure\` to be an integer from \`concurrency\` (${concurrency}) and up or \`Infinity\`, got \`${backpressure}\` (${typeof backpressure})`);
+  }
+  return {
+    async *[Symbol.asyncIterator]() {
+      const iterator = iterable[Symbol.asyncIterator] === void 0 ? iterable[Symbol.iterator]() : iterable[Symbol.asyncIterator]();
+      const promises = [];
+      let pendingPromisesCount = 0;
+      let isDone = false;
+      let index = 0;
+      function trySpawn() {
+        if (isDone || !(pendingPromisesCount < concurrency && promises.length < backpressure)) {
+          return;
+        }
+        pendingPromisesCount++;
+        const promise = (async () => {
+          const { done, value } = await iterator.next();
+          if (done) {
+            pendingPromisesCount--;
+            return { done: true };
+          }
+          trySpawn();
+          try {
+            const returnValue = await mapper(await value, index++);
+            pendingPromisesCount--;
+            if (returnValue === pMapSkip) {
+              const index2 = promises.indexOf(promise);
+              if (index2 > 0) {
+                promises.splice(index2, 1);
+              }
+            }
+            trySpawn();
+            return { done: false, value: returnValue };
+          } catch (error) {
+            pendingPromisesCount--;
+            isDone = true;
+            return { error };
+          }
+        })();
+        promises.push(promise);
+      }
+      __name(trySpawn, "trySpawn");
+      trySpawn();
+      while (promises.length > 0) {
+        const { error, done, value } = await promises[0];
+        promises.shift();
+        if (error) {
+          throw error;
+        }
+        if (done) {
+          return;
+        }
+        trySpawn();
+        if (value === pMapSkip) {
+          continue;
+        }
+        yield value;
+      }
+    }
+  };
+}
+var pMapSkip;
+var init_p_map = __esm({
+  "node_modules/.pnpm/p-map@7.0.4/node_modules/p-map/index.js"() {
+    __name(pMap, "pMap");
+    __name(pMapIterable, "pMapIterable");
+    pMapSkip = Symbol("skip");
+  }
+});
+
+// src/external/p-map.js
+module.exports = (init_p_map(), __toCommonJS(p_map_exports));

package/dist/external/pico-pack.js

@@ -39,12 +39,13 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// node_modules/.pnpm/picomatch@4.0.3/node_modules/picomatch/lib/constants.js
+// node_modules/.pnpm/picomatch@4.0.4/node_modules/picomatch/lib/constants.js
 var require_constants = __commonJS({
-  "node_modules/.pnpm/picomatch@4.0.3/node_modules/picomatch/lib/constants.js"(exports2, module2) {
+  "node_modules/.pnpm/picomatch@4.0.4/node_modules/picomatch/lib/constants.js"(exports2, module2) {
     "use strict";
     var WIN_SLASH = "\\\\/";
     var WIN_NO_SLASH = `[^${WIN_SLASH}]`;
+    var DEFAULT_MAX_EXTGLOB_RECURSION = 0;
     var DOT_LITERAL = "\\.";
     var PLUS_LITERAL = "\\+";
     var QMARK_LITERAL = "\\?";
@@ -95,6 +96,7 @@ var require_constants = __commonJS({
       SEP: "\\"
     };
     var POSIX_REGEX_SOURCE = {
+      __proto__: null,
       alnum: "a-zA-Z0-9",
       alpha: "a-zA-Z",
       ascii: "\\x00-\\x7F",
@@ -111,6 +113,7 @@ var require_constants = __commonJS({
       xdigit: "A-Fa-f0-9"
     };
     module2.exports = {
+      DEFAULT_MAX_EXTGLOB_RECURSION,
       MAX_LENGTH: 1024 * 64,
       POSIX_REGEX_SOURCE,
       // regular expressions
@@ -238,9 +241,9 @@ var require_constants = __commonJS({
   }
 });
 
-// node_modules/.pnpm/picomatch@4.0.3/node_modules/picomatch/lib/utils.js
+// node_modules/.pnpm/picomatch@4.0.4/node_modules/picomatch/lib/utils.js
 var require_utils = __commonJS({
-  "node_modules/.pnpm/picomatch@4.0.3/node_modules/picomatch/lib/utils.js"(exports2) {
+  "node_modules/.pnpm/picomatch@4.0.4/node_modules/picomatch/lib/utils.js"(exports2) {
     "use strict";
     var {
       REGEX_BACKSLASH,
@@ -302,9 +305,9 @@ var require_utils = __commonJS({
   }
 });
 
-// node_modules/.pnpm/picomatch@4.0.3/node_modules/picomatch/lib/scan.js
+// node_modules/.pnpm/picomatch@4.0.4/node_modules/picomatch/lib/scan.js
 var require_scan = __commonJS({
-  "node_modules/.pnpm/picomatch@4.0.3/node_modules/picomatch/lib/scan.js"(exports2, module2) {
+  "node_modules/.pnpm/picomatch@4.0.4/node_modules/picomatch/lib/scan.js"(exports2, module2) {
     "use strict";
     var utils = require_utils();
     var {
@@ -632,9 +635,9 @@ var require_scan = __commonJS({
   }
 });
 
-// node_modules/.pnpm/picomatch@4.0.3/node_modules/picomatch/lib/parse.js
+// node_modules/.pnpm/picomatch@4.0.4/node_modules/picomatch/lib/parse.js
 var require_parse = __commonJS({
-  "node_modules/.pnpm/picomatch@4.0.3/node_modules/picomatch/lib/parse.js"(exports2, module2) {
+  "node_modules/.pnpm/picomatch@4.0.4/node_modules/picomatch/lib/parse.js"(exports2, module2) {
     "use strict";
     var constants = require_constants();
     var utils = require_utils();
@@ -661,6 +664,213 @@ var require_parse = __commonJS({
     var syntaxError = /* @__PURE__ */ __name((type, char) => {
       return `Missing ${type}: "${char}" - use "\\\\${char}" to match literal characters`;
     }, "syntaxError");
+    var splitTopLevel = /* @__PURE__ */ __name((input) => {
+      const parts = [];
+      let bracket = 0;
+      let paren = 0;
+      let quote = 0;
+      let value = "";
+      let escaped = false;
+      for (const ch of input) {
+        if (escaped === true) {
+          value += ch;
+          escaped = false;
+          continue;
+        }
+        if (ch === "\\") {
+          value += ch;
+          escaped = true;
+          continue;
+        }
+        if (ch === '"') {
+          quote = quote === 1 ? 0 : 1;
+          value += ch;
+          continue;
+        }
+        if (quote === 0) {
+          if (ch === "[") {
+            bracket++;
+          } else if (ch === "]" && bracket > 0) {
+            bracket--;
+          } else if (bracket === 0) {
+            if (ch === "(") {
+              paren++;
+            } else if (ch === ")" && paren > 0) {
+              paren--;
+            } else if (ch === "|" && paren === 0) {
+              parts.push(value);
+              value = "";
+              continue;
+            }
+          }
+        }
+        value += ch;
+      }
+      parts.push(value);
+      return parts;
+    }, "splitTopLevel");
+    var isPlainBranch = /* @__PURE__ */ __name((branch) => {
+      let escaped = false;
+      for (const ch of branch) {
+        if (escaped === true) {
+          escaped = false;
+          continue;
+        }
+        if (ch === "\\") {
+          escaped = true;
+          continue;
+        }
+        if (/[?*+@!()[\]{}]/.test(ch)) {
+          return false;
+        }
+      }
+      return true;
+    }, "isPlainBranch");
+    var normalizeSimpleBranch = /* @__PURE__ */ __name((branch) => {
+      let value = branch.trim();
+      let changed = true;
+      while (changed === true) {
+        changed = false;
+        if (/^@\([^\\()[\]{}|]+\)$/.test(value)) {
+          value = value.slice(2, -1);
+          changed = true;
+        }
+      }
+      if (!isPlainBranch(value)) {
+        return;
+      }
+      return value.replace(/\\(.)/g, "$1");
+    }, "normalizeSimpleBranch");
+    var hasRepeatedCharPrefixOverlap = /* @__PURE__ */ __name((branches) => {
+      const values = branches.map(normalizeSimpleBranch).filter(Boolean);
+      for (let i = 0; i < values.length; i++) {
+        for (let j = i + 1; j < values.length; j++) {
+          const a = values[i];
+          const b = values[j];
+          const char = a[0];
+          if (!char || a !== char.repeat(a.length) || b !== char.repeat(b.length)) {
+            continue;
+          }
+          if (a === b || a.startsWith(b) || b.startsWith(a)) {
+            return true;
+          }
+        }
+      }
+      return false;
+    }, "hasRepeatedCharPrefixOverlap");
+    var parseRepeatedExtglob = /* @__PURE__ */ __name((pattern, requireEnd = true) => {
+      if (pattern[0] !== "+" && pattern[0] !== "*" || pattern[1] !== "(") {
+        return;
+      }
+      let bracket = 0;
+      let paren = 0;
+      let quote = 0;
+      let escaped = false;
+      for (let i = 1; i < pattern.length; i++) {
+        const ch = pattern[i];
+        if (escaped === true) {
+          escaped = false;
+          continue;
+        }
+        if (ch === "\\") {
+          escaped = true;
+          continue;
+        }
+        if (ch === '"') {
+          quote = quote === 1 ? 0 : 1;
+          continue;
+        }
+        if (quote === 1) {
+          continue;
+        }
+        if (ch === "[") {
+          bracket++;
+          continue;
+        }
+        if (ch === "]" && bracket > 0) {
+          bracket--;
+          continue;
+        }
+        if (bracket > 0) {
+          continue;
+        }
+        if (ch === "(") {
+          paren++;
+          continue;
+        }
+        if (ch === ")") {
+          paren--;
+          if (paren === 0) {
+            if (requireEnd === true && i !== pattern.length - 1) {
+              return;
+            }
+            return {
+              type: pattern[0],
+              body: pattern.slice(2, i),
+              end: i
+            };
+          }
+        }
+      }
+    }, "parseRepeatedExtglob");
+    var getStarExtglobSequenceOutput = /* @__PURE__ */ __name((pattern) => {
+      let index = 0;
+      const chars = [];
+      while (index < pattern.length) {
+        const match = parseRepeatedExtglob(pattern.slice(index), false);
+        if (!match || match.type !== "*") {
+          return;
+        }
+        const branches = splitTopLevel(match.body).map((branch2) => branch2.trim());
+        if (branches.length !== 1) {
+          return;
+        }
+        const branch = normalizeSimpleBranch(branches[0]);
+        if (!branch || branch.length !== 1) {
+          return;
+        }
+        chars.push(branch);
+        index += match.end + 1;
+      }
+      if (chars.length < 1) {
+        return;
+      }
+      const source = chars.length === 1 ? utils.escapeRegex(chars[0]) : `[${chars.map((ch) => utils.escapeRegex(ch)).join("")}]`;
+      return `${source}*`;
+    }, "getStarExtglobSequenceOutput");
+    var repeatedExtglobRecursion = /* @__PURE__ */ __name((pattern) => {
+      let depth = 0;
+      let value = pattern.trim();
+      let match = parseRepeatedExtglob(value);
+      while (match) {
+        depth++;
+        value = match.body.trim();
+        match = parseRepeatedExtglob(value);
+      }
+      return depth;
+    }, "repeatedExtglobRecursion");
+    var analyzeRepeatedExtglob = /* @__PURE__ */ __name((body, options) => {
+      if (options.maxExtglobRecursion === false) {
+        return { risky: false };
+      }
+      const max = typeof options.maxExtglobRecursion === "number" ? options.maxExtglobRecursion : constants.DEFAULT_MAX_EXTGLOB_RECURSION;
+      const branches = splitTopLevel(body).map((branch) => branch.trim());
+      if (branches.length > 1) {
+        if (branches.some((branch) => branch === "") || branches.some((branch) => /^[*?]+$/.test(branch)) || hasRepeatedCharPrefixOverlap(branches)) {
+          return { risky: true };
+        }
+      }
+      for (const branch of branches) {
+        const safeOutput = getStarExtglobSequenceOutput(branch);
+        if (safeOutput) {
+          return { risky: true, safeOutput };
+        }
+        if (repeatedExtglobRecursion(branch) > max) {
+          return { risky: true };
+        }
+      }
+      return { risky: false };
+    }, "analyzeRepeatedExtglob");
     var parse = /* @__PURE__ */ __name((input, options) => {
       if (typeof input !== "string") {
         throw new TypeError("Expected a string");
@@ -791,6 +1001,8 @@ var require_parse = __commonJS({
         token.prev = prev;
         token.parens = state.parens;
         token.output = state.output;
+        token.startIndex = state.index;
+        token.tokensIndex = tokens.length;
         const output = (opts.capture ? "(" : "") + token.open;
         increment("parens");
         push({ type, value: value2, output: state.output ? "" : ONE_CHAR });
@@ -798,6 +1010,26 @@ var require_parse = __commonJS({
         extglobs.push(token);
       }, "extglobOpen");
       const extglobClose = /* @__PURE__ */ __name((token) => {
+        const literal = input.slice(token.startIndex, state.index + 1);
+        const body = input.slice(token.startIndex + 2, state.index);
+        const analysis = analyzeRepeatedExtglob(body, opts);
+        if ((token.type === "plus" || token.type === "star") && analysis.risky) {
+          const safeOutput = analysis.safeOutput ? (token.output ? "" : ONE_CHAR) + (opts.capture ? `(${analysis.safeOutput})` : analysis.safeOutput) : void 0;
+          const open = tokens[token.tokensIndex];
+          open.type = "text";
+          open.value = literal;
+          open.output = safeOutput || utils.escapeRegex(literal);
+          for (let i = token.tokensIndex + 1; i < tokens.length; i++) {
+            tokens[i].value = "";
+            tokens[i].output = "";
+            delete tokens[i].suffix;
+          }
+          state.output = token.output + open.output;
+          state.backtrack = true;
+          push({ type: "paren", extglob: true, value, output: "" });
+          decrement("parens");
+          return;
+        }
         let output = token.close + (opts.capture ? ")" : "");
         let rest;
         if (token.type === "negate") {
@@ -1400,9 +1632,9 @@ var require_parse = __commonJS({
   }
 });
 
-// node_modules/.pnpm/picomatch@4.0.3/node_modules/picomatch/lib/picomatch.js
+// node_modules/.pnpm/picomatch@4.0.4/node_modules/picomatch/lib/picomatch.js
 var require_picomatch = __commonJS({
-  "node_modules/.pnpm/picomatch@4.0.3/node_modules/picomatch/lib/picomatch.js"(exports2, module2) {
+  "node_modules/.pnpm/picomatch@4.0.4/node_modules/picomatch/lib/picomatch.js"(exports2, module2) {
     "use strict";
     var scan = require_scan();
     var parse = require_parse();
@@ -1540,9 +1772,9 @@ var require_picomatch = __commonJS({
   }
 });
 
-// node_modules/.pnpm/picomatch@4.0.3/node_modules/picomatch/index.js
+// node_modules/.pnpm/picomatch@4.0.4/node_modules/picomatch/index.js
 var require_picomatch2 = __commonJS({
-  "node_modules/.pnpm/picomatch@4.0.3/node_modules/picomatch/index.js"(exports2, module2) {
+  "node_modules/.pnpm/picomatch@4.0.4/node_modules/picomatch/index.js"(exports2, module2) {
     "use strict";
     var pico = require_picomatch();
     var utils = require_utils();
@@ -2618,6 +2850,7 @@ var require_compile = __commonJS({
           return prefix + node.value;
         }
         if (node.isClose === true) {
+          /* @__PURE__ */ console.log("node.isClose", prefix, node.value);
           return prefix + node.value;
         }
         if (node.type === "open") {

package/dist/external/zod.js

@@ -13207,6 +13207,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
           result.$schema = "http://json-schema.org/draft-04/schema#";
         } else if (this.target === "openapi-3.0") {
         } else {
+          /* @__PURE__ */ console.warn(`Invalid target: ${this.target}`);
         }
         if (params.external?.uri) {
           const id = params.external.registry.get(schema)?.id;

package/dist/github.js

@@ -203,11 +203,9 @@ async function cacheFetchGhsa(ghsaId, options) {
   if (import_node_process.default.env["DISABLE_GITHUB_CACHE"]) {
     return await fetchGhsaDetails(ghsaId, options);
   }
-  const cached = await cache.getOrFetch(key, async () => {
-    const data = await fetchGhsaDetails(ghsaId, options);
-    return JSON.stringify(data);
+  return await cache.getOrFetch(key, async () => {
+    return await fetchGhsaDetails(ghsaId, options);
   });
-  return JSON.parse(cached);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/http-request.js

@@ -311,6 +311,9 @@ async function httpRequestAttempt(url, options) {
           };
           resolve(response);
         });
+        res.on("error", (error) => {
+          reject(error);
+        });
       }
     );
     request.on("error", (error) => {

package/dist/ipc.js

@@ -239,6 +239,7 @@ function waitForIpc(messageType, options = {}) {
     cleanup = onIpc(handleMessage);
     if (timeout > 0) {
       timeoutId = setTimeout(handleTimeout, timeout);
+      timeoutId.unref();
     }
   });
 }