@st-gr/sail-proxy 0.9.2 → 0.9.4

package/bundled/gateway/node_modules/form-data/README.md

@@ -6,11 +6,11 @@ The API of this library is inspired by the [XMLHttpRequest-2 FormData Interface]
 
 [xhr2-fd]: http://dev.w3.org/2006/webapi/XMLHttpRequest-2/Overview.html#the-formdata-interface
 
-[![Linux Build](https://img.shields.io/travis/form-data/form-data/v4.0.5.svg?label=linux:6.x-12.x)](https://travis-ci.org/form-data/form-data)
-[![MacOS Build](https://img.shields.io/travis/form-data/form-data/v4.0.5.svg?label=macos:6.x-12.x)](https://travis-ci.org/form-data/form-data)
-[![Windows Build](https://img.shields.io/travis/form-data/form-data/v4.0.5.svg?label=windows:6.x-12.x)](https://travis-ci.org/form-data/form-data)
+[![Linux Build](https://img.shields.io/travis/form-data/form-data/v4.0.6.svg?label=linux:6.x-12.x)](https://travis-ci.org/form-data/form-data)
+[![MacOS Build](https://img.shields.io/travis/form-data/form-data/v4.0.6.svg?label=macos:6.x-12.x)](https://travis-ci.org/form-data/form-data)
+[![Windows Build](https://img.shields.io/travis/form-data/form-data/v4.0.6.svg?label=windows:6.x-12.x)](https://travis-ci.org/form-data/form-data)
 
-[![Coverage Status](https://img.shields.io/coveralls/form-data/form-data/v4.0.5.svg?label=code+coverage)](https://coveralls.io/github/form-data/form-data?branch=master)
+[![Coverage Status](https://img.shields.io/coveralls/form-data/form-data/v4.0.6.svg?label=code+coverage)](https://coveralls.io/github/form-data/form-data?branch=master)
 [![Dependency Status](https://img.shields.io/david/form-data/form-data.svg)](https://david-dm.org/form-data/form-data)
 
 ## Install

package/bundled/gateway/node_modules/form-data/lib/form_data.js

@@ -15,6 +15,18 @@ var setToStringTag = require('es-set-tostringtag');
 var hasOwn = require('hasown');
 var populate = require('./populate.js');
 
+/**
+ * Escape CR, LF, and `"` in a multipart `name`/`filename` parameter, so a field
+ * name or filename can not break out of its header line to inject headers or
+ * smuggle additional parts. Matches the WHATWG HTML multipart/form-data encoding.
+ *
+ * @param {string} str - the parameter value to escape
+ * @returns {string} the escaped value
+ */
+function escapeHeaderParam(str) {
+  return String(str).replace(/\r/g, '%0D').replace(/\n/g, '%0A').replace(/"/g, '%22');
+}
+
 /**
  * Create readable "multipart/form-data" streams.
  * Can be used to submit forms
@@ -180,7 +192,7 @@ FormData.prototype._multiPartHeader = function (field, value, options) {
   var contents = '';
   var headers = {
     // add custom disposition as third element or keep it two elements if not
-    'Content-Disposition': ['form-data', 'name="' + field + '"'].concat(contentDisposition || []),
+    'Content-Disposition': ['form-data', 'name="' + escapeHeaderParam(field) + '"'].concat(contentDisposition || []),
     // if no content type. allow it to be empty array
     'Content-Type': [].concat(contentType || [])
   };
@@ -234,7 +246,7 @@ FormData.prototype._getContentDisposition = function (value, options) { // eslin
   }
 
   if (filename) {
-    return 'filename="' + filename + '"';
+    return 'filename="' + escapeHeaderParam(filename) + '"';
   }
 };
 

package/bundled/gateway/node_modules/form-data/package.json

@@ -2,7 +2,7 @@
   "author": "Felix Geisendörfer <felix@debuggable.com> (http://debuggable.com/)",
   "name": "form-data",
   "description": "A library to create readable \"multipart/form-data\" streams. Can be used to submit forms and file uploads to other web applications.",
-  "version": "4.0.5",
+  "version": "4.0.6",
   "repository": {
     "type": "git",
     "url": "git://github.com/form-data/form-data.git"
@@ -43,12 +43,12 @@
     "asynckit": "^0.4.0",
     "combined-stream": "^1.0.8",
     "es-set-tostringtag": "^2.1.0",
-    "hasown": "^2.0.2",
-    "mime-types": "^2.1.12"
+    "hasown": "^2.0.4",
+    "mime-types": "^2.1.35"
   },
   "devDependencies": {
-    "@ljharb/eslint-config": "^21.4.0",
-    "auto-changelog": "^2.5.0",
+    "@ljharb/eslint-config": "^22.2.3",
+    "auto-changelog": "^2.6.0",
     "browserify": "^13.3.0",
     "browserify-istanbul": "^2.0.0",
     "coveralls": "^3.1.1",
@@ -60,7 +60,7 @@
     "in-publish": "^2.0.1",
     "is-node-modern": "^1.0.0",
     "istanbul": "^0.4.5",
-    "js-randomness-predictor": "^1.5.5",
+    "js-randomness-predictor": "^3.6.0",
     "obake": "^0.1.2",
     "pkgfiles": "^2.3.2",
     "pre-commit": "^1.2.2",
@@ -68,7 +68,7 @@
     "request": "~2.87.0",
     "rimraf": "^2.7.1",
     "semver": "^6.3.1",
-    "tape": "^5.9.0"
+    "tape": "^5.10.1"
   },
   "license": "MIT",
   "auto-changelog": {

package/bundled/gateway/node_modules/http-errors/HISTORY.md

@@ -1,9 +1,3 @@
-2.0.1 / 2025-11-20
-==================
-
-  * deps: use tilde notation for dependencies
-  * deps: update statuses to 2.0.2
-
 2.0.0 / 2021-12-17
 ==================
 

package/bundled/gateway/node_modules/http-errors/index.js

@@ -279,12 +279,11 @@ function populateConstructorExports (exports, codes, HttpError) {
 
 /**
  * Get a class name from a name identifier.
- *
- * @param {string} name
- * @returns {string}
  * @private
  */
 
 function toClassName (name) {
-  return name.slice(-5) === 'Error' ? name : name + 'Error'
+  return name.substr(-5) !== 'Error'
+    ? name + 'Error'
+    : name
 }

package/bundled/gateway/node_modules/http-errors/package.json

@@ -1,7 +1,7 @@
 {
   "name": "http-errors",
   "description": "Create HTTP error objects",
-  "version": "2.0.1",
+  "version": "2.0.0",
   "author": "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)",
   "contributors": [
     "Alan Plum <me@pluma.io>",
@@ -9,21 +9,17 @@
   ],
   "license": "MIT",
   "repository": "jshttp/http-errors",
-  "funding": {
-    "type": "opencollective",
-    "url": "https://opencollective.com/express"
-  },
   "dependencies": {
-    "depd": "~2.0.0",
-    "inherits": "~2.0.4",
-    "setprototypeof": "~1.2.0",
-    "statuses": "~2.0.2",
-    "toidentifier": "~1.0.1"
+    "depd": "2.0.0",
+    "inherits": "2.0.4",
+    "setprototypeof": "1.2.0",
+    "statuses": "2.0.1",
+    "toidentifier": "1.0.1"
   },
   "devDependencies": {
     "eslint": "7.32.0",
     "eslint-config-standard": "14.1.1",
-    "eslint-plugin-import": "2.32.0",
+    "eslint-plugin-import": "2.25.3",
     "eslint-plugin-markdown": "2.2.1",
     "eslint-plugin-node": "11.1.0",
     "eslint-plugin-promise": "5.2.0",
@@ -36,7 +32,7 @@
   },
   "scripts": {
     "lint": "eslint . && node ./scripts/lint-readme-list.js",
-    "test": "mocha --reporter spec",
+    "test": "mocha --reporter spec --bail",
     "test-ci": "nyc --reporter=lcov --reporter=text npm test",
     "test-cov": "nyc --reporter=html --reporter=text npm test",
     "version": "node scripts/version-history.js && git add HISTORY.md"

package/bundled/gateway/node_modules/raw-body/HISTORY.md

@@ -0,0 +1,308 @@
+2.5.2 / 2023-02-21
+==================
+
+  * Fix error message for non-stream argument
+
+2.5.1 / 2022-02-28
+==================
+
+  * Fix error on early async hooks implementations
+
+2.5.0 / 2022-02-21
+==================
+
+  * Prevent loss of async hooks context
+  * Prevent hanging when stream is not readable
+  * deps: http-errors@2.0.0
+    - deps: depd@2.0.0
+    - deps: statuses@2.0.1
+
+2.4.3 / 2022-02-14
+==================
+
+  * deps: bytes@3.1.2
+
+2.4.2 / 2021-11-16
+==================
+
+  * deps: bytes@3.1.1
+  * deps: http-errors@1.8.1
+    - deps: setprototypeof@1.2.0
+    - deps: toidentifier@1.0.1
+
+2.4.1 / 2019-06-25
+==================
+
+  * deps: http-errors@1.7.3
+    - deps: inherits@2.0.4
+
+2.4.0 / 2019-04-17
+==================
+
+  * deps: bytes@3.1.0
+    - Add petabyte (`pb`) support
+  * deps: http-errors@1.7.2
+    - Set constructor name when possible
+    - deps: setprototypeof@1.1.1
+    - deps: statuses@'>= 1.5.0 < 2'
+  * deps: iconv-lite@0.4.24
+    - Added encoding MIK
+
+2.3.3 / 2018-05-08
+==================
+
+  * deps: http-errors@1.6.3
+    - deps: depd@~1.1.2
+    - deps: setprototypeof@1.1.0
+    - deps: statuses@'>= 1.3.1 < 2'
+  * deps: iconv-lite@0.4.23
+    - Fix loading encoding with year appended
+    - Fix deprecation warnings on Node.js 10+
+
+2.3.2 / 2017-09-09
+==================
+
+  * deps: iconv-lite@0.4.19
+    - Fix ISO-8859-1 regression
+    - Update Windows-1255
+
+2.3.1 / 2017-09-07
+==================
+
+  * deps: bytes@3.0.0
+  * deps: http-errors@1.6.2
+    - deps: depd@1.1.1
+  * perf: skip buffer decoding on overage chunk
+
+2.3.0 / 2017-08-04
+==================
+
+  * Add TypeScript definitions
+  * Use `http-errors` for standard emitted errors
+  * deps: bytes@2.5.0
+  * deps: iconv-lite@0.4.18
+    - Add support for React Native
+    - Add a warning if not loaded as utf-8
+    - Fix CESU-8 decoding in Node.js 8
+    - Improve speed of ISO-8859-1 encoding
+
+2.2.0 / 2017-01-02
+==================
+
+  * deps: iconv-lite@0.4.15
+    - Added encoding MS-31J
+    - Added encoding MS-932
+    - Added encoding MS-936
+    - Added encoding MS-949
+    - Added encoding MS-950
+    - Fix GBK/GB18030 handling of Euro character
+
+2.1.7 / 2016-06-19
+==================
+
+  * deps: bytes@2.4.0
+  * perf: remove double-cleanup on happy path
+
+2.1.6 / 2016-03-07
+==================
+
+  * deps: bytes@2.3.0
+    - Drop partial bytes on all parsed units
+    - Fix parsing byte string that looks like hex
+
+2.1.5 / 2015-11-30
+==================
+
+  * deps: bytes@2.2.0
+  * deps: iconv-lite@0.4.13
+
+2.1.4 / 2015-09-27
+==================
+
+  * Fix masking critical errors from `iconv-lite`
+  * deps: iconv-lite@0.4.12
+    - Fix CESU-8 decoding in Node.js 4.x
+
+2.1.3 / 2015-09-12
+==================
+
+  * Fix sync callback when attaching data listener causes sync read
+    - Node.js 0.10 compatibility issue
+
+2.1.2 / 2015-07-05
+==================
+
+  * Fix error stack traces to skip `makeError`
+  * deps: iconv-lite@0.4.11
+    - Add encoding CESU-8
+
+2.1.1 / 2015-06-14
+==================
+
+  * Use `unpipe` module for unpiping requests
+
+2.1.0 / 2015-05-28
+==================
+
+  * deps: iconv-lite@0.4.10
+    - Improved UTF-16 endianness detection
+    - Leading BOM is now removed when decoding
+    - The encoding UTF-16 without BOM now defaults to UTF-16LE when detection fails
+
+2.0.2 / 2015-05-21
+==================
+
+  * deps: bytes@2.1.0
+    - Slight optimizations
+
+2.0.1 / 2015-05-10
+==================
+
+  * Fix a false-positive when unpiping in Node.js 0.8
+
+2.0.0 / 2015-05-08
+==================
+
+  * Return a promise without callback instead of thunk
+  * deps: bytes@2.0.1
+    - units no longer case sensitive when parsing
+
+1.3.4 / 2015-04-15
+==================
+
+  * Fix hanging callback if request aborts during read
+  * deps: iconv-lite@0.4.8
+    - Add encoding alias UNICODE-1-1-UTF-7
+
+1.3.3 / 2015-02-08
+==================
+
+  * deps: iconv-lite@0.4.7
+    - Gracefully support enumerables on `Object.prototype`
+
+1.3.2 / 2015-01-20
+==================
+
+  * deps: iconv-lite@0.4.6
+    - Fix rare aliases of single-byte encodings
+
+1.3.1 / 2014-11-21
+==================
+
+  * deps: iconv-lite@0.4.5
+    - Fix Windows-31J and X-SJIS encoding support
+
+1.3.0 / 2014-07-20
+==================
+
+  * Fully unpipe the stream on error
+    - Fixes `Cannot switch to old mode now` error on Node.js 0.10+
+
+1.2.3 / 2014-07-20
+==================
+
+  * deps: iconv-lite@0.4.4
+    - Added encoding UTF-7
+
+1.2.2 / 2014-06-19
+==================
+
+  * Send invalid encoding error to callback
+
+1.2.1 / 2014-06-15
+==================
+
+  * deps: iconv-lite@0.4.3
+    - Added encodings UTF-16BE and UTF-16 with BOM
+
+1.2.0 / 2014-06-13
+==================
+
+  * Passing string as `options` interpreted as encoding
+  * Support all encodings from `iconv-lite`
+
+1.1.7 / 2014-06-12
+==================
+
+  * use `string_decoder` module from npm
+
+1.1.6 / 2014-05-27
+==================
+
+  * check encoding for old streams1
+  * support node.js < 0.10.6
+
+1.1.5 / 2014-05-14
+==================
+
+  * bump bytes
+
+1.1.4 / 2014-04-19
+==================
+
+  * allow true as an option
+  * bump bytes
+
+1.1.3 / 2014-03-02
+==================
+
+  * fix case when length=null
+
+1.1.2 / 2013-12-01
+==================
+
+  * be less strict on state.encoding check
+
+1.1.1 / 2013-11-27
+==================
+
+  * add engines
+
+1.1.0 / 2013-11-27
+==================
+
+  * add err.statusCode and err.type
+  * allow for encoding option to be true
+  * pause the stream instead of dumping on error
+  * throw if the stream's encoding is set
+
+1.0.1 / 2013-11-19
+==================
+
+  * dont support streams1, throw if dev set encoding
+
+1.0.0 / 2013-11-17
+==================
+
+  * rename `expected` option to `length`
+
+0.2.0 / 2013-11-15
+==================
+
+  * republish
+
+0.1.1 / 2013-11-15
+==================
+
+  * use bytes
+
+0.1.0 / 2013-11-11
+==================
+
+  * generator support
+
+0.0.3 / 2013-10-10
+==================
+
+  * update repo
+
+0.0.2 / 2013-09-14
+==================
+
+  * dump stream on bad headers
+  * listen to events after defining received and buffers
+
+0.0.1 / 2013-09-14
+==================
+
+  * Initial release

package/bundled/gateway/node_modules/raw-body/SECURITY.md

@@ -0,0 +1,24 @@
+# Security Policies and Procedures
+
+## Reporting a Bug
+
+The `raw-body` team and community take all security bugs seriously. Thank you
+for improving the security of Express. We appreciate your efforts and
+responsible disclosure and will make every effort to acknowledge your
+contributions.
+
+Report security bugs by emailing the current owners of `raw-body`. This information
+can be found in the npm registry using the command `npm owner ls raw-body`.
+If unsure or unable to get the information from the above, open an issue
+in the [project issue tracker](https://github.com/stream-utils/raw-body/issues)
+asking for the current contact information.
+
+To ensure the timely response to your report, please ensure that the entirety
+of the report is contained within the email body and not solely behind a web
+link or an attachment.
+
+At least one owner will acknowledge your email within 48 hours, and will send a
+more detailed response within 48 hours indicating the next steps in handling
+your report. After the initial reply to your report, the owners will
+endeavor to keep you informed of the progress towards a fix and full
+announcement, and may ask for additional information or guidance.

package/bundled/gateway/node_modules/raw-body/package.json

@@ -1,7 +1,7 @@
 {
   "name": "raw-body",
   "description": "Get and validate the raw body of a readable stream.",
-  "version": "2.5.3",
+  "version": "2.5.2",
   "author": "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
@@ -10,10 +10,10 @@
   "license": "MIT",
   "repository": "stream-utils/raw-body",
   "dependencies": {
-    "bytes": "~3.1.2",
-    "http-errors": "~2.0.1",
-    "iconv-lite": "~0.4.24",
-    "unpipe": "~1.0.0"
+    "bytes": "3.1.2",
+    "http-errors": "2.0.0",
+    "iconv-lite": "0.4.24",
+    "unpipe": "1.0.0"
   },
   "devDependencies": {
     "bluebird": "3.7.2",
@@ -33,8 +33,10 @@
     "node": ">= 0.8"
   },
   "files": [
+    "HISTORY.md",
     "LICENSE",
     "README.md",
+    "SECURITY.md",
     "index.d.ts",
     "index.js"
   ],

package/bundled/gateway/node_modules/semver/classes/range.js

@@ -277,6 +277,11 @@ const parseComparator = (comp, options) => {
 
 const isX = id => !id || id.toLowerCase() === 'x' || id === '*'
 
+const invalidXRangeOrder = (M, m, p) => (
+  (isX(M) && !isX(m)) ||
+  (isX(m) && p && !isX(p))
+)
+
 // ~, ~> --> * (any, kinda silly)
 // ~2, ~2.x, ~2.x.x, ~>2, ~>2.x ~>2.x.x --> >=2.0.0 <3.0.0-0
 // ~2.0, ~2.0.x, ~>2.0, ~>2.0.x --> >=2.0.0 <2.1.0-0
@@ -294,6 +299,10 @@ const replaceTildes = (comp, options) => {
 
 const replaceTilde = (comp, options) => {
   const r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE]
+  // if we're including prereleases in the match, then the lower bound is
+  // -0, the lowest possible prerelease value, just like x-ranges and carets.
+  // this keeps `~1.2` equivalent to the `1.2.x` x-range it's documented as.
+  const z = options.includePrerelease ? '-0' : ''
   return comp.replace(r, (_, M, m, p, pr) => {
     debug('tilde', comp, _, M, m, p, pr)
     let ret
@@ -301,10 +310,10 @@ const replaceTilde = (comp, options) => {
     if (isX(M)) {
       ret = ''
     } else if (isX(m)) {
-      ret = `>=${M}.0.0 <${+M + 1}.0.0-0`
+      ret = `>=${M}.0.0${z} <${+M + 1}.0.0-0`
     } else if (isX(p)) {
       // ~1.2 == >=1.2.0 <1.3.0-0
-      ret = `>=${M}.${m}.0 <${M}.${+m + 1}.0-0`
+      ret = `>=${M}.${m}.0${z} <${M}.${+m + 1}.0-0`
     } else if (pr) {
       debug('replaceTilde pr', pr)
       ret = `>=${M}.${m}.${p}-${pr
@@ -373,10 +382,10 @@ const replaceCaret = (comp, options) => {
       if (M === '0') {
         if (m === '0') {
           ret = `>=${M}.${m}.${p
-          }${z} <${M}.${m}.${+p + 1}-0`
+          } <${M}.${m}.${+p + 1}-0`
         } else {
           ret = `>=${M}.${m}.${p
-          }${z} <${M}.${+m + 1}.0-0`
+          } <${M}.${+m + 1}.0-0`
         }
       } else {
         ret = `>=${M}.${m}.${p
@@ -402,6 +411,10 @@ const replaceXRange = (comp, options) => {
   const r = options.loose ? re[t.XRANGELOOSE] : re[t.XRANGE]
   return comp.replace(r, (ret, gtlt, M, m, p, pr) => {
     debug('xRange', comp, ret, gtlt, M, m, p, pr)
+    if (invalidXRangeOrder(M, m, p)) {
+      return comp
+    }
+
     const xM = isX(M)
     const xm = xM || isX(m)
     const xp = xm || isX(p)

package/bundled/gateway/node_modules/semver/package.json

@@ -1,6 +1,6 @@
 {
   "name": "semver",
-  "version": "7.8.2",
+  "version": "7.8.5",
   "description": "The semantic version parser used by npm.",
   "main": "index.js",
   "scripts": {
@@ -14,7 +14,7 @@
     "eslint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\""
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^6.0.0",
+    "@npmcli/eslint-config": "^7.0.0",
     "@npmcli/template-oss": "5.0.0",
     "benchmark": "^2.1.4",
     "tap": "^16.0.0"

package/bundled/gateway/node_modules/send/HISTORY.md

@@ -1,15 +1,3 @@
-0.19.2 / 2025-12-15
-===================
-
-* deps: use tilde notation for dependencies
-* deps: http-errors@~2.0.1
-* deps: statuses@~2.0.2
-
-0.19.1 / 2024-10-09
-===================
-
-* deps: encodeurl@~2.0.0
-
 0.19.0 / 2024-09-10
 ===================
 
@@ -497,37 +485,37 @@
 
  * update range-parser and fresh
 
-0.1.4 / 2013-08-11
+0.1.4 / 2013-08-11 
 ==================
 
  * update fresh
 
-0.1.3 / 2013-07-08
+0.1.3 / 2013-07-08 
 ==================
 
  * Revert "Fix fd leak"
 
-0.1.2 / 2013-07-03
+0.1.2 / 2013-07-03 
 ==================
 
  * Fix fd leak
 
-0.1.0 / 2012-08-25
+0.1.0 / 2012-08-25 
 ==================
 
   * add options parameter to send() that is passed to fs.createReadStream() [kanongil]
 
-0.0.4 / 2012-08-16
+0.0.4 / 2012-08-16 
 ==================
 
   * allow custom "Accept-Ranges" definition
 
-0.0.3 / 2012-07-16
+0.0.3 / 2012-07-16 
 ==================
 
   * fix normalization of the root directory. Closes #3
 
-0.0.2 / 2012-07-09
+0.0.2 / 2012-07-09 
 ==================
 
   * add passing of req explicitly for now (YUCK)

package/bundled/gateway/node_modules/send/node_modules/encodeurl/HISTORY.md

@@ -0,0 +1,14 @@
+1.0.2 / 2018-01-21
+==================
+
+  * Fix encoding `%` as last character
+
+1.0.1 / 2016-06-09
+==================
+
+  * Fix encoding unpaired surrogates at start/end of string
+
+1.0.0 / 2016-06-08
+==================
+
+  * Initial release