@vltpkg/cli-js 1.0.3 → 1.0.4

package/{access-5WETTBDZ.js → access-RYNHM3DJ.js}

@@ -19,7 +19,7 @@ import "./chunk-XU5SMHXP.js";
 import "./chunk-WP6CYBPM.js";
 import {
   RegistryClient
-} from "./chunk-HNCE3YE5.js";
+} from "./chunk-2CLRMD5A.js";
 import "./chunk-HAYXR3MW.js";
 import "./chunk-E74WGW5C.js";
 import "./chunk-LPIBYUMT.js";

package/{bugs-KONFLIQQ.js → bugs-ZHOC4U52.js}

@@ -14,19 +14,19 @@ import {
 } from "./chunk-CLVRCGOZ.js";
 import {
   createHostContextsMap
-} from "./chunk-TMBNGWXK.js";
+} from "./chunk-MZIM7X37.js";
 import {
   PackageInfoClient
-} from "./chunk-G7UPIJAP.js";
-import "./chunk-FWKQ7YDF.js";
+} from "./chunk-AK3RSABL.js";
+import "./chunk-ZWKI5OSF.js";
 import {
   Query,
   actual
-} from "./chunk-LZGKX7JI.js";
+} from "./chunk-OR5LSCSK.js";
 import {
   SecurityArchive
-} from "./chunk-5B23EKN4.js";
-import "./chunk-FFOXTPQA.js";
+} from "./chunk-WNDUKE42.js";
+import "./chunk-PDLEQEZ3.js";
 import "./chunk-OCJDISSI.js";
 import {
   commandUsage

package/{build-S7G2DU7I.js → build-HTM6Z7OQ.js}

@@ -11,9 +11,9 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   build
-} from "./chunk-LZGKX7JI.js";
-import "./chunk-5B23EKN4.js";
-import "./chunk-FFOXTPQA.js";
+} from "./chunk-OR5LSCSK.js";
+import "./chunk-WNDUKE42.js";
+import "./chunk-PDLEQEZ3.js";
 import "./chunk-OCJDISSI.js";
 import {
   commandUsage

package/{cache-Z4OIMLXQ.js → cache-74GIE5TO.js}

@@ -34,7 +34,7 @@ import {
 } from "./chunk-4KCU2KZL.js";
 import {
   CacheEntry
-} from "./chunk-HNCE3YE5.js";
+} from "./chunk-2CLRMD5A.js";
 import "./chunk-HAYXR3MW.js";
 import "./chunk-E74WGW5C.js";
 import "./chunk-LPIBYUMT.js";

package/cache-unzip-src-unzip.js

@@ -4544,6 +4544,15 @@ var Cache = class _Cache extends I {
 import { pathToFileURL } from "node:url";
 import { gunzipSync } from "node:zlib";
 var __CODE_SPLIT_SCRIPT_NAME = import.meta.filename;
+var MAX_DECOMPRESSION_RATIO = 1e3;
+var defaultMaxUnpackedBytes = 2 * 1024 * 1024 * 1024;
+var parseMaxUnpackedBytes = (raw) => {
+  const n7 = Number(raw);
+  return Number.isFinite(n7) && n7 >= 1 ? Math.floor(n7) : defaultMaxUnpackedBytes;
+};
+var maxUnpackedBytes = parseMaxUnpackedBytes(
+  process.env.VLT_TAR_MAX_UNPACKED_BYTES
+);
 var isMain = (path) => path === __CODE_SPLIT_SCRIPT_NAME || path === pathToFileURL(__CODE_SPLIT_SCRIPT_NAME).toString();
 var main = async (path, input = process.stdin) => {
   if (!path) {
@@ -4586,7 +4595,20 @@ var main = async (path, input = process.stdin) => {
       const headSizeOriginal = readSize(buffer, 0);
       const body = buffer.subarray(headSizeOriginal);
       if (body[0] === 31 && body[1] === 139) {
-        const unz = gunzipSync(body);
+        let unz;
+        try {
+          unz = gunzipSync(body, {
+            maxOutputLength: Math.min(
+              maxUnpackedBytes,
+              body.length * MAX_DECOMPRESSION_RATIO
+            )
+          });
+        } catch (er) {
+          if (er.code !== "ERR_BUFFER_TOO_LARGE") {
+            throw er;
+          }
+          return null;
+        }
         const headersBuffer = buffer.subarray(7, headSizeOriginal);
         const headers = [];
         let i = 0;