@st-gr/sail-proxy 0.9.2 → 0.9.3

package/bundled/ollama/node_modules/axios/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axios",
-  "version": "1.17.0",
+  "version": "1.16.1",
   "description": "Promise based HTTP client for the browser and node.js",
   "main": "./dist/node/axios.cjs",
   "module": "./index.js",
@@ -86,8 +86,8 @@
     "Justin Beckwith (https://github.com/JustinBeckwith)",
     "Martti Laine (https://github.com/codeclown)",
     "Xianming Zhong (https://github.com/chinesedfan)",
-    "Shaan Majid (https://github.com/shaanmajid)",
     "Willian Agostini (https://github.com/WillianAgostini)",
+    "Shaan Majid (https://github.com/shaanmajid)",
     "Remco Haszing (https://github.com/remcohaszing)",
     "Rikki Gibson (https://github.com/RikkiGibson)"
   ],
@@ -97,22 +97,6 @@
     "url": "https://github.com/axios/axios/issues"
   },
   "homepage": "https://axios-http.com",
-  "files": [
-    "index.js",
-    "index.d.ts",
-    "index.d.cts",
-    "CHANGELOG.md",
-    "MIGRATION_GUIDE.md",
-    "lib/",
-    "dist/axios.js",
-    "dist/axios.min.js",
-    "dist/axios.min.js.map",
-    "dist/esm/axios.js",
-    "dist/esm/axios.min.js",
-    "dist/esm/axios.min.js.map",
-    "dist/browser/axios.cjs",
-    "dist/node/axios.cjs"
-  ],
   "scripts": {
     "build": "gulp clear && cross-env NODE_ENV=production rollup -c -m",
     "version": "npm run build && git add package.json",
@@ -144,9 +128,9 @@
   },
   "devDependencies": {
     "@babel/core": "^7.29.0",
-    "@babel/preset-env": "^7.29.5",
-    "@commitlint/cli": "^21.0.1",
-    "@commitlint/config-conventional": "^21.0.1",
+    "@babel/preset-env": "^7.29.2",
+    "@commitlint/cli": "^20.5.0",
+    "@commitlint/config-conventional": "^20.5.0",
     "@eslint/js": "^10.0.1",
     "@rollup/plugin-alias": "^6.0.0",
     "@rollup/plugin-babel": "^7.0.0",
@@ -154,34 +138,34 @@
     "@rollup/plugin-json": "^6.1.0",
     "@rollup/plugin-node-resolve": "^16.0.3",
     "@rollup/plugin-terser": "^1.0.0",
-    "@vitest/browser": "^4.1.7",
-    "@vitest/browser-playwright": "^4.1.7",
+    "@vitest/browser": "^4.1.5",
+    "@vitest/browser-playwright": "^4.1.5",
     "abortcontroller-polyfill": "^1.7.8",
     "acorn": "^8.16.0",
     "body-parser": "^2.2.2",
     "chalk": "^5.6.2",
     "cross-env": "^10.1.0",
     "dev-null": "^0.1.1",
-    "eslint": "^10.4.0",
+    "eslint": "^10.2.1",
     "express": "^5.2.1",
     "formdata-node": "^6.0.3",
     "formidable": "^3.5.4",
     "fs-extra": "^11.3.4",
     "get-stream": "^9.0.1",
-    "globals": "^17.6.0",
+    "globals": "^17.5.0",
     "gulp": "^5.0.1",
     "husky": "^9.1.7",
-    "lint-staged": "^17.0.5",
+    "lint-staged": "^16.4.0",
     "minimist": "^1.2.8",
     "multer": "^2.1.1",
-    "playwright": "^1.60.0",
+    "playwright": "^1.59.1",
     "prettier": "^3.8.3",
-    "rollup": "^4.60.4",
+    "rollup": "^4.60.2",
     "rollup-plugin-bundle-size": "^1.0.3",
     "selfsigned": "^5.5.0",
     "stream-throttle": "^0.1.3",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.5"
   },
   "commitlint": {
     "rules": {

package/bundled/ollama/node_modules/body-parser/HISTORY.md

@@ -1,17 +1,3 @@
-1.20.5 / 2026-04-24
-===================
-* refactor(json): simplify strict mode error string construction 
-* fix: extended urlencoded parsing of arrays with >100 elements (#716)
-* deps: qs@~6.15.1
-
-1.20.4 / 2025-12-01
-===================
-
-  * deps: qs@~6.14.0
-  * deps: use tilde notation for dependencies
-  * deps: http-errors@~2.0.1
-  * deps: raw-body@~2.5.3
-
 1.20.3 / 2024-09-10
 ===================
 

package/bundled/ollama/node_modules/body-parser/SECURITY.md

@@ -0,0 +1,25 @@
+# Security Policies and Procedures
+
+## Reporting a Bug
+
+The Express team and community take all security bugs seriously. Thank you
+for improving the security of Express. We appreciate your efforts and
+responsible disclosure and will make every effort to acknowledge your
+contributions.
+
+Report security bugs by emailing the current owner(s) of `body-parser`. This
+information can be found in the npm registry using the command
+`npm owner ls body-parser`.
+If unsure or unable to get the information from the above, open an issue
+in the [project issue tracker](https://github.com/expressjs/body-parser/issues)
+asking for the current contact information.
+
+To ensure the timely response to your report, please ensure that the entirety
+of the report is contained within the email body and not solely behind a web
+link or an attachment.
+
+At least one owner will acknowledge your email within 48 hours, and will send a
+more detailed response within 48 hours indicating the next steps in handling
+your report. After the initial reply to your report, the owners will
+endeavor to keep you informed of the progress towards a fix and full
+announcement, and may ask for additional information or guidance.

package/bundled/ollama/node_modules/body-parser/lib/types/json.js

@@ -158,7 +158,11 @@ function createStrictSyntaxError (str, char) {
   var partial = ''
 
   if (index !== -1) {
-    partial = str.substring(0, index) + new Array(str.length - index + 1).join(JSON_SYNTAX_CHAR)
+    partial = str.substring(0, index) + JSON_SYNTAX_CHAR
+
+    for (var i = index + 1; i < str.length; i++) {
+      partial += JSON_SYNTAX_CHAR
+    }
   }
 
   try {

package/bundled/ollama/node_modules/body-parser/lib/types/urlencoded.js

@@ -55,6 +55,9 @@ function urlencoded (options) {
     : opts.limit
   var type = opts.type || 'application/x-www-form-urlencoded'
   var verify = opts.verify || false
+  var depth = typeof opts.depth !== 'number'
+    ? Number(opts.depth || 32)
+    : opts.depth
 
   if (verify !== false && typeof verify !== 'function') {
     throw new TypeError('option verify must be function')
@@ -118,7 +121,8 @@ function urlencoded (options) {
       encoding: charset,
       inflate: inflate,
       limit: limit,
-      verify: verify
+      verify: verify,
+      depth: depth
     })
   }
 }
@@ -133,7 +137,10 @@ function extendedparser (options) {
   var parameterLimit = options.parameterLimit !== undefined
     ? options.parameterLimit
     : 1000
-  var depth = options.depth !== undefined ? options.depth : 32
+
+  var depth = typeof options.depth !== 'number'
+    ? Number(options.depth || 32)
+    : options.depth
   var parse = parser('qs')
 
   if (isNaN(parameterLimit) || parameterLimit < 1) {
@@ -206,15 +213,16 @@ function getCharset (req) {
 
 function parameterCount (body, limit) {
   var count = 0
-  var index = -1
+  var index = 0
 
-  do {
+  while ((index = body.indexOf('&', index)) !== -1) {
     count++
-    if (count > limit) {
+    index++
+
+    if (count === limit) {
       return undefined
     }
-    index = body.indexOf('&', index + 1)
-  } while (index !== -1)
+  }
 
   return count
 }

package/bundled/ollama/node_modules/body-parser/package.json

@@ -1,7 +1,7 @@
 {
   "name": "body-parser",
   "description": "Node.js body parsing middleware",
-  "version": "1.20.5",
+  "version": "1.20.3",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)"
@@ -9,18 +9,18 @@
   "license": "MIT",
   "repository": "expressjs/body-parser",
   "dependencies": {
-    "bytes": "~3.1.2",
+    "bytes": "3.1.2",
     "content-type": "~1.0.5",
     "debug": "2.6.9",
     "depd": "2.0.0",
-    "destroy": "~1.2.0",
-    "http-errors": "~2.0.1",
-    "iconv-lite": "~0.4.24",
-    "on-finished": "~2.4.1",
-    "qs": "~6.15.1",
-    "raw-body": "~2.5.3",
+    "destroy": "1.2.0",
+    "http-errors": "2.0.0",
+    "iconv-lite": "0.4.24",
+    "on-finished": "2.4.1",
+    "qs": "6.13.0",
+    "raw-body": "2.5.2",
     "type-is": "~1.6.18",
-    "unpipe": "~1.0.0"
+    "unpipe": "1.0.0"
   },
   "devDependencies": {
     "eslint": "8.34.0",
@@ -40,6 +40,7 @@
     "lib/",
     "LICENSE",
     "HISTORY.md",
+    "SECURITY.md",
     "index.js"
   ],
   "engines": {

package/bundled/ollama/node_modules/cookie/index.js

@@ -21,7 +21,6 @@ exports.serialize = serialize;
  */
 
 var __toString = Object.prototype.toString
-var __hasOwnProperty = Object.prototype.hasOwnProperty
 
 /**
  * RegExp to match cookie-name in RFC 6265 sec 4.1.1
@@ -65,15 +64,9 @@ var cookieValueRegExp = /^("?)[\u0021\u0023-\u002B\u002D-\u003A\u003C-\u005B\u00
  * <letter>          = any one of the 52 alphabetic characters A through Z in
  *                     upper case and a through z in lower case
  * <digit>           = any one of the ten digits 0 through 9
- *
- * Keep support for leading dot: https://github.com/jshttp/cookie/issues/173
- *
- * > (Note that a leading %x2E ("."), if present, is ignored even though that
- * character is not permitted, but a trailing %x2E ("."), if present, will
- * cause the user agent to ignore the attribute.)
  */
 
-var domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+var domainValueRegExp = /^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
 
 /**
  * RegExp to match path-value in RFC 6265 sec 4.1.1
@@ -92,12 +85,12 @@ var pathValueRegExp = /^[\u0020-\u003A\u003D-\u007E]*$/;
  * The object has the various cookies as keys(names) => values
  *
  * @param {string} str
- * @param {object} [opt]
+ * @param {object} [options]
  * @return {object}
  * @public
  */
 
-function parse(str, opt) {
+function parse(str, options) {
   if (typeof str !== 'string') {
     throw new TypeError('argument str must be a string');
   }
@@ -105,16 +98,21 @@ function parse(str, opt) {
   var obj = {};
   var len = str.length;
   // RFC 6265 sec 4.1.1, RFC 2616 2.2 defines a cookie name consists of one char minimum, plus '='.
-  if (len < 2) return obj;
+  var max = len - 2;
+  if (max < 0) return obj;
 
-  var dec = (opt && opt.decode) || decode;
+  var dec = (options && options.decode) || decode;
   var index = 0;
   var eqIdx = 0;
   var endIdx = 0;
 
   do {
     eqIdx = str.indexOf('=', index);
-    if (eqIdx === -1) break; // No more cookie pairs.
+
+    // no more cookie pairs
+    if (eqIdx === -1) {
+      break;
+    }
 
     endIdx = str.indexOf(';', index);
 
@@ -131,7 +129,7 @@ function parse(str, opt) {
     var key = str.slice(keyStartIdx, keyEndIdx);
 
     // only assign once
-    if (!__hasOwnProperty.call(obj, key)) {
+    if (undefined === obj[key]) {
       var valStartIdx = startIndex(str, eqIdx + 1, endIdx);
       var valEndIdx = endIndex(str, endIdx, valStartIdx);
 
@@ -145,7 +143,7 @@ function parse(str, opt) {
     }
 
     index = endIdx + 1
-  } while (index < len);
+  } while (index < max);
 
   return obj;
 }
@@ -177,13 +175,14 @@ function endIndex(str, index, min) {
  *
  * @param {string} name
  * @param {string} val
- * @param {object} [opt]
+ * @param {object} [options]
  * @return {string}
  * @public
  */
 
-function serialize(name, val, opt) {
-  var enc = (opt && opt.encode) || encodeURIComponent;
+function serialize(name, val, options) {
+  var opt = options || {};
+  var enc = opt.encode || encode;
 
   if (typeof enc !== 'function') {
     throw new TypeError('option encode is invalid');
@@ -195,21 +194,20 @@ function serialize(name, val, opt) {
 
   var value = enc(val);
 
-  if (!cookieValueRegExp.test(value)) {
+  if (value && !cookieValueRegExp.test(value)) {
     throw new TypeError('argument val is invalid');
   }
 
   var str = name + '=' + value;
-  if (!opt) return str;
 
   if (null != opt.maxAge) {
-    var maxAge = Math.floor(opt.maxAge);
+    var maxAge = opt.maxAge - 0;
 
     if (!isFinite(maxAge)) {
       throw new TypeError('option maxAge is invalid')
     }
 
-    str += '; Max-Age=' + maxAge;
+    str += '; Max-Age=' + Math.floor(maxAge);
   }
 
   if (opt.domain) {
@@ -252,7 +250,8 @@ function serialize(name, val, opt) {
 
   if (opt.priority) {
     var priority = typeof opt.priority === 'string'
-      ? opt.priority.toLowerCase() : opt.priority;
+      ? opt.priority.toLowerCase()
+      : opt.priority
 
     switch (priority) {
       case 'low':
@@ -307,6 +306,17 @@ function decode (str) {
     : str
 }
 
+/**
+ * URL-encode value.
+ *
+ * @param {string} val
+ * @returns {string}
+ */
+
+function encode (val) {
+  return encodeURIComponent(val)
+}
+
 /**
  * Determine if value is a Date.
  *
@@ -315,7 +325,8 @@ function decode (str) {
  */
 
 function isDate (val) {
-  return __toString.call(val) === '[object Date]';
+  return __toString.call(val) === '[object Date]' ||
+    val instanceof Date
 }
 
 /**

package/bundled/ollama/node_modules/cookie/package.json

@@ -1,7 +1,7 @@
 {
   "name": "cookie",
   "description": "HTTP server cookie parsing and serialization",
-  "version": "0.7.2",
+  "version": "0.7.0",
   "author": "Roman Shtylman <shtylman@gmail.com>",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>"

package/bundled/ollama/node_modules/cookie-signature/History.md

@@ -1,14 +1,10 @@
-1.0.7 / 2023-04-12
-==================
-
-* backport the buffer support from the 1.2.x release branch (thanks @FadhiliNjagi!)
-
 1.0.6 / 2015-02-03
 ==================
 
 * use `npm test` instead of `make test` to run tests
 * clearer assertion messages when checking input
 
+
 1.0.5 / 2014-09-05
 ==================
 

package/bundled/ollama/node_modules/cookie-signature/index.js

@@ -8,14 +8,14 @@ var crypto = require('crypto');
  * Sign the given `val` with `secret`.
  *
  * @param {String} val
- * @param {String|NodeJS.ArrayBufferView|crypto.KeyObject} secret
+ * @param {String} secret
  * @return {String}
  * @api private
  */
 
 exports.sign = function(val, secret){
-  if ('string' !== typeof val) throw new TypeError("Cookie value must be provided as a string.");
-  if (null == secret) throw new TypeError("Secret key must be provided.");
+  if ('string' != typeof val) throw new TypeError("Cookie value must be provided as a string.");
+  if ('string' != typeof secret) throw new TypeError("Secret string must be provided.");
   return val + '.' + crypto
     .createHmac('sha256', secret)
     .update(val)
@@ -28,14 +28,14 @@ exports.sign = function(val, secret){
  * returning `false` if the signature is invalid.
  *
  * @param {String} val
- * @param {String|NodeJS.ArrayBufferView|crypto.KeyObject} secret
+ * @param {String} secret
  * @return {String|Boolean}
  * @api private
  */
 
 exports.unsign = function(val, secret){
-  if ('string' !== typeof val) throw new TypeError("Signed cookie string must be provided.");
-  if (null == secret) throw new TypeError("Secret key must be provided.");
+  if ('string' != typeof val) throw new TypeError("Signed cookie string must be provided.");
+  if ('string' != typeof secret) throw new TypeError("Secret string must be provided.");
   var str = val.slice(0, val.lastIndexOf('.'))
     , mac = exports.sign(str, secret);
   

package/bundled/ollama/node_modules/cookie-signature/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cookie-signature",
-  "version": "1.0.7",
+  "version": "1.0.6",
   "description": "Sign and unsign cookies",
   "keywords": ["cookie", "sign", "unsign"],
   "author": "TJ Holowaychuk <tj@learnboost.com>",
@@ -15,4 +15,4 @@
     "test": "mocha --require should --reporter spec"
   },
   "main": "index"
-}
+}

package/bundled/ollama/node_modules/express/History.md

@@ -1,46 +1,3 @@
-4.22.2 / 2026-05-011
-==========
-
-* fix: restore >20 array parsing for `req.query` repeated keys ([`8d09bfe6`](https://github.com/expressjs/express/commit/8d09bfe6d88983da5c3e12cfdd54782c4dc675db))
-  * This also unifies array-cap behavior across notations. Indexed notation (`a[0]=...`) was historically capped at qs's default `arrayLimit` of 20 even in older qs versions; after this change it also allows up to 1000 items.
-* deps: qs@~6.15.1
-* deps: body-parser@~1.20.5
-
-4.22.1 / 2025-12-01
-==========
-
-  * Revert security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6))
-    * The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
-
-4.22.0 / 2025-12-01
-==========
-  * Security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6))
-  * deps: use tilde notation for dependencies
-  * deps: qs@6.14.0
-
-4.21.2 / 2024-11-06
-==========
-
-  * deps: path-to-regexp@0.1.12
-    - Fix backtracking protection
-  * deps: path-to-regexp@0.1.11
-    - Throws an error on invalid path values
-
-4.21.1 / 2024-10-08
-==========
-
-  * Backported a fix for [CVE-2024-47764](https://nvd.nist.gov/vuln/detail/CVE-2024-47764)
-
-
-4.21.0 / 2024-09-11
-==========
-
-  * Deprecate `res.location("back")` and `res.redirect("back")` magic string
-  * deps: serve-static@1.16.2
-    * includes send@0.19.0
-  * deps: finalhandler@1.3.1
-  * deps: qs@6.13.0
-
 4.20.0 / 2024-09-10
 ==========
   * deps: serve-static@0.16.0

package/bundled/ollama/node_modules/express/lib/response.js

@@ -916,7 +916,6 @@ res.location = function location(url) {
 
   // "back" is an alias for the referrer
   if (url === 'back') {
-    deprecate('res.location("back"): use res.location(req.get("Referrer") || "/") and refer to https://dub.sh/security-redirect for best practices');
     loc = this.req.get('Referrer') || '/';
   } else {
     loc = String(url);

package/bundled/ollama/node_modules/express/lib/utils.js

@@ -287,8 +287,7 @@ function createETagGenerator (options) {
 
 function parseExtendedQueryString(str) {
   return qs.parse(str, {
-    allowPrototypes: true,
-    arrayLimit: 1000
+    allowPrototypes: true
   });
 }
 

package/bundled/ollama/node_modules/express/package.json

@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.22.2",
+  "version": "4.20.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",
@@ -15,10 +15,6 @@
   "license": "MIT",
   "repository": "expressjs/express",
   "homepage": "http://expressjs.com/",
-  "funding": {
-    "type": "opencollective",
-    "url": "https://opencollective.com/express"
-  },
   "keywords": [
     "express",
     "framework",
@@ -34,32 +30,32 @@
   "dependencies": {
     "accepts": "~1.3.8",
     "array-flatten": "1.1.1",
-    "body-parser": "~1.20.5",
-    "content-disposition": "~0.5.4",
+    "body-parser": "1.20.3",
+    "content-disposition": "0.5.4",
     "content-type": "~1.0.4",
-    "cookie": "~0.7.1",
-    "cookie-signature": "~1.0.6",
+    "cookie": "0.6.0",
+    "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "2.0.0",
     "encodeurl": "~2.0.0",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",
-    "finalhandler": "~1.3.1",
-    "fresh": "~0.5.2",
-    "http-errors": "~2.0.0",
+    "finalhandler": "1.2.0",
+    "fresh": "0.5.2",
+    "http-errors": "2.0.0",
     "merge-descriptors": "1.0.3",
     "methods": "~1.1.2",
-    "on-finished": "~2.4.1",
+    "on-finished": "2.4.1",
     "parseurl": "~1.3.3",
-    "path-to-regexp": "~0.1.12",
+    "path-to-regexp": "0.1.10",
     "proxy-addr": "~2.0.7",
-    "qs": "~6.15.1",
+    "qs": "6.11.0",
     "range-parser": "~1.2.1",
     "safe-buffer": "5.2.1",
-    "send": "~0.19.0",
-    "serve-static": "~1.16.2",
+    "send": "0.19.0",
+    "serve-static": "1.16.0",
     "setprototypeof": "1.2.0",
-    "statuses": "~2.0.1",
+    "statuses": "2.0.1",
     "type-is": "~1.6.18",
     "utils-merge": "1.0.1",
     "vary": "~1.1.2"
@@ -75,11 +71,11 @@
     "hbs": "4.2.0",
     "marked": "0.7.0",
     "method-override": "3.0.0",
-    "mocha": "^6.2.2",
+    "mocha": "10.2.0",
     "morgan": "1.10.0",
-    "nyc": "^14.1.1",
+    "nyc": "15.1.0",
     "pbkdf2-password": "1.2.1",
-    "supertest": "^6.1.6",
+    "supertest": "6.3.0",
     "vhost": "~3.0.2"
   },
   "engines": {

package/bundled/ollama/node_modules/finalhandler/HISTORY.md

@@ -1,24 +1,3 @@
-v1.3.2 / 2025-12-01
-==================
-
-  * deps: use tilde notation for dependencies
-  * deps: statuses@~2.0.2
-
-v1.3.1 / 2024-09-11
-==================
-
-  * deps: encodeurl@~2.0.0
-
-v1.3.0 / 2024-09-03
-==================
-
-  * ignore status message for HTTP/2 (#53)
-
-v1.2.1 / 2024-09-02
-==================
-
-  * Gracefully handle when handling an error and socket is null
-
 1.2.0 / 2022-03-22
 ==================